CVE-2022-28508

Опубликовано: 04 мая 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

Ссылки

https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurability
Exploit
Third Party Advisory
https://mantisbt.org/
Vendor Advisory
https://sourceforge.net/projects/mantisbt/
Product
Third Party Advisory
https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurability
Exploit
Third Party Advisory
https://mantisbt.org/
Vendor Advisory
https://sourceforge.net/projects/mantisbt/
Product
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

Версия до 2.25.2 (исключая)

EPSS

Процентиль: 81%

0.01452

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2022-28508

CVSS3: 6.1

debian

почти 4 года назад

An XSS issue was discovered in browser_search_plugin.php in MantisBT b ...

GHSA-wfg2-2wmw-6894

CVSS3: 6.1

github

почти 4 года назад

MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php

EPSS

Процентиль: 81%

0.01452

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79