The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
2015-02-10T20:59:00.060
2025-04-12T10:46:40.837
Deferred
CVSSv2: 5.8 (MEDIUM)
AV:N/AC:M/Au:N/C:P/I:P/A:N
8.6
4.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | mantisbt | mantisbt | 1.2.0 | Yes |
| Application | mantisbt | mantisbt | 1.2.0 | Yes |
| Application | mantisbt | mantisbt | 1.2.0 | Yes |
| Application | mantisbt | mantisbt | 1.2.1 | Yes |
| Application | mantisbt | mantisbt | 1.2.2 | Yes |
| Application | mantisbt | mantisbt | 1.2.3 | Yes |
| Application | mantisbt | mantisbt | 1.2.4 | Yes |
| Application | mantisbt | mantisbt | 1.2.5 | Yes |
| Application | mantisbt | mantisbt | 1.2.6 | Yes |
| Application | mantisbt | mantisbt | 1.2.7 | Yes |
| Application | mantisbt | mantisbt | 1.2.8 | Yes |
| Application | mantisbt | mantisbt | 1.2.9 | Yes |
| Application | mantisbt | mantisbt | 1.2.10 | Yes |
| Application | mantisbt | mantisbt | 1.2.11 | Yes |
| Application | mantisbt | mantisbt | 1.2.12 | Yes |
| Application | mantisbt | mantisbt | 1.2.13 | Yes |
| Application | mantisbt | mantisbt | 1.2.14 | Yes |
| Application | mantisbt | mantisbt | 1.2.15 | Yes |
| Application | mantisbt | mantisbt | 1.2.16 | Yes |
| Application | mantisbt | mantisbt | 1.2.17 | Yes |
| Application | mantisbt | mantisbt | 1.2.18 | Yes |