En resumen
- CVE-2017-7620 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a mantisbt/mantisbt, mantisbt (mantisbt).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 71.7% de las vulnerabilidades.
- Solución: actualizar a 2.3.3, 2.4.1, 1.3.11 o posterior.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.0.0, < 2.3.3≥ 2.4.0, < 2.4.1< 1.3.11
| 2.3.32.4.11.3.11
|
| mantisbt | = 2.0.0= 2.0.1= 2.1.0= 2.1.1= 2.1.2= 2.2.0= 2.2.2= 2.2.3= 2.2.4= 2.4.0≤ 1.3.10
| No fix yet |
Description
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial / substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
NVD description
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Más vulnerabilidades de mantisbt/mantisbt
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free