Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-3578

Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357.

Published

2011-09-21T16:55:05.240

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mantisbt	mantisbt	≤ 1.2.7	Yes
Application	mantisbt	mantisbt	0.19.3	Yes
Application	mantisbt	mantisbt	0.19.4	Yes
Application	mantisbt	mantisbt	1.0.0	Yes
Application	mantisbt	mantisbt	1.0.1	Yes
Application	mantisbt	mantisbt	1.0.2	Yes
Application	mantisbt	mantisbt	1.0.3	Yes
Application	mantisbt	mantisbt	1.0.4	Yes
Application	mantisbt	mantisbt	1.0.5	Yes
Application	mantisbt	mantisbt	1.0.6	Yes
Application	mantisbt	mantisbt	1.0.7	Yes
Application	mantisbt	mantisbt	1.0.8	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.1	Yes
Application	mantisbt	mantisbt	1.1.2	Yes
Application	mantisbt	mantisbt	1.1.4	Yes
Application	mantisbt	mantisbt	1.1.5	Yes
Application	mantisbt	mantisbt	1.1.6	Yes
Application	mantisbt	mantisbt	1.1.7	Yes
Application	mantisbt	mantisbt	1.1.8	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.1	Yes
Application	mantisbt	mantisbt	1.2.2	Yes
Application	mantisbt	mantisbt	1.2.3	Yes
Application	mantisbt	mantisbt	1.2.4	Yes
Application	mantisbt	mantisbt	1.2.5	Yes
Application	mantisbt	mantisbt	1.2.6	Yes

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 Exploit, Patch ([email protected])
http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html Exploit, Patch ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html Exploit, Patch ([email protected])
http://secunia.com/advisories/45961 Vendor Advisory ([email protected])
http://secunia.com/advisories/51199 ([email protected])
http://security.gentoo.org/glsa/glsa-201211-01.xml ([email protected])
http://securityreason.com/securityalert/8392 ([email protected])
http://www.debian.org/security/2011/dsa-2308 ([email protected])
http://www.mantisbt.org/bugs/view.php?id=13281 Exploit ([email protected])
http://www.openwall.com/lists/oss-security/2011/09/04/1 Exploit ([email protected])
http://www.openwall.com/lists/oss-security/2011/09/04/2 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/09/09/9 Exploit ([email protected])
http://www.securityfocus.com/archive/1/519547/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/49448 ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=735514 Exploit, Patch ([email protected])
https://github.com/mantisbt/mantisbt/commit/5b93161f3ece2f73410c296fed8522f6475d273d Patch ([email protected])
https://github.com/mantisbt/mantisbt/commit/6ede60d3db9e202044f135001589cce941ff6f0f Patch ([email protected])
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html Exploit ([email protected])
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45961 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/51199 (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-201211-01.xml (af854a3a-2127-422b-91ae-364da2661108)
http://securityreason.com/securityalert/8392 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2011/dsa-2308 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mantisbt.org/bugs/view.php?id=13281 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/09/04/1 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/09/04/2 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/09/09/9 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/519547/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/49448 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=735514 Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/mantisbt/mantisbt/commit/5b93161f3ece2f73410c296fed8522f6475d273d Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/mantisbt/mantisbt/commit/6ede60d3db9e202044f135001589cce941ff6f0f Patch (af854a3a-2127-422b-91ae-364da2661108)
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html Exploit (af854a3a-2127-422b-91ae-364da2661108)