National Cyber Awareness System

Vulnerability Summary for CVE-2011-2938

Overview

Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b

Type: Patch Information

Hyperlink:https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=731777

Type: Patch Information; Exploit

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=731777

External Source: CONFIRM

Name: https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857

Type: Patch Information; Exploit

Hyperlink:https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857

External Source: CONFIRM

Name: https://bugs.gentoo.org/show_bug.cgi?id=379739

Type: Patch Information; Exploit

Hyperlink:https://bugs.gentoo.org/show_bug.cgi?id=379739

External Source: MLIST

Name: [oss-security] 20110819 Re: CVE request: MantisBT <1.2.7 search.php multiple XSS vulnerabilities

Type: Patch Information; Exploit

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/19/16

External Source: MLIST

Name: [oss-security] 20110819 CVE request: MantisBT <1.2.7 search.php multiple XSS vulnerabilities

Type: Patch Information; Exploit

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/18/7

External Source: FEDORA

Name: FEDORA-2011-12369

Type: Patch Information; Exploit

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html

External Source: BID

Name: 49235

Hyperlink:http://www.securityfocus.com/bid/49235

External Source: CONFIRM

Name: http://www.mantisbt.org/bugs/view.php?id=13245

Hyperlink:http://www.mantisbt.org/bugs/view.php?id=13245

External Source: SREASON

Name: 8391

Hyperlink:http://securityreason.com/securityalert/8391

External Source: MISC

Name: http://packetstormsecurity.org/files/104149

Hyperlink:http://packetstormsecurity.org/files/104149