Описание
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
Ссылки
- PatchThird Party Advisory
- ExploitIssue TrackingVendor Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 2.13.0 (включая) до 2.21.1 (включая)
cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
EPSS
Процентиль: 73%
0.00745
Низкий
9.6 Critical
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 9.6
debian
больше 6 лет назад
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 ha ...
github
больше 3 лет назад
MantisBT allows cross-site scripting (XSS) via crafted filename
EPSS
Процентиль: 73%
0.00745
Низкий
9.6 Critical
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-79