CVE-2018-16514

Опубликовано: 20 июн. 2019

Источник: nvd

CVSS3: 4.7

CVSS2: 2.6

EPSS Низкий

Описание

A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.

Ссылки

https://mantisbt.org/bugs/view.php?id=24731
Exploit
Issue Tracking
Vendor Advisory
https://mantisbt.org/bugs/view.php?id=24731
Exploit
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

Версия от 2.1.0 (включая) до 2.17.0 (включая)

EPSS

Процентиль: 48%

0.00253

Низкий

4.7 Medium

CVSS3

2.6 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2018-16514

CVSS3: 4.7

debian

больше 6 лет назад

A cross-site scripting (XSS) vulnerability in the View Filters page (v ...

GHSA-3qv7-98vm-xx2v

CVSS3: 6.1

github

больше 3 лет назад

MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO