Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-3358

Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library.

Published

2011-09-21T16:55:05.180

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mantisbt	mantisbt	≤ 1.2.7	Yes
Application	mantisbt	mantisbt	0.19.3	Yes
Application	mantisbt	mantisbt	0.19.4	Yes
Application	mantisbt	mantisbt	1.0.0	Yes
Application	mantisbt	mantisbt	1.0.1	Yes
Application	mantisbt	mantisbt	1.0.2	Yes
Application	mantisbt	mantisbt	1.0.3	Yes
Application	mantisbt	mantisbt	1.0.4	Yes
Application	mantisbt	mantisbt	1.0.5	Yes
Application	mantisbt	mantisbt	1.0.6	Yes
Application	mantisbt	mantisbt	1.0.7	Yes
Application	mantisbt	mantisbt	1.0.8	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.1	Yes
Application	mantisbt	mantisbt	1.1.2	Yes
Application	mantisbt	mantisbt	1.1.4	Yes
Application	mantisbt	mantisbt	1.1.5	Yes
Application	mantisbt	mantisbt	1.1.6	Yes
Application	mantisbt	mantisbt	1.1.7	Yes
Application	mantisbt	mantisbt	1.1.8	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.1	Yes
Application	mantisbt	mantisbt	1.2.2	Yes
Application	mantisbt	mantisbt	1.2.3	Yes
Application	mantisbt	mantisbt	1.2.4	Yes
Application	mantisbt	mantisbt	1.2.5	Yes
Application	mantisbt	mantisbt	1.2.6	Yes

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 Exploit, Patch ([email protected])
http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html Exploit ([email protected])
http://secunia.com/advisories/45961 Vendor Advisory ([email protected])
http://secunia.com/advisories/51199 ([email protected])
http://security.gentoo.org/glsa/glsa-201211-01.xml ([email protected])
http://securityreason.com/securityalert/8392 ([email protected])
http://www.debian.org/security/2011/dsa-2308 Exploit, Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/09/04/1 Exploit ([email protected])
http://www.openwall.com/lists/oss-security/2011/09/09/9 Exploit ([email protected])
http://www.securityfocus.com/archive/1/519547/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/49448 ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=735514 Exploit, Patch ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/69589 ([email protected])
https://github.com/mantisbt/mantisbt/commit/0a636b37d3425aea7b781e7f25eaeb164ac54a3d Patch ([email protected])
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html Exploit ([email protected])
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45961 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/51199 (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-201211-01.xml (af854a3a-2127-422b-91ae-364da2661108)
http://securityreason.com/securityalert/8392 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2011/dsa-2308 Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/09/04/1 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/09/09/9 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/519547/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/49448 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=735514 Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/69589 (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/mantisbt/mantisbt/commit/0a636b37d3425aea7b781e7f25eaeb164ac54a3d Patch (af854a3a-2127-422b-91ae-364da2661108)
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html Exploit (af854a3a-2127-422b-91ae-364da2661108)