| Package | Affected versions | Patched versions |
|---|---|---|
| mantisbt/mantisbt | ≥ 2.0.0, < 2.3.3≥ 2.4.0, < 2.4.1< 1.3.11 | 2.3.32.4.11.3.11 |
| mantisbt | = 2.0.0= 2.0.1= 2.1.0= 2.1.1= 2.1.2= 2.2.0= 2.2.2= 2.2.3= 2.2.4= 2.4.0≤ 1.3.10 |
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial / substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free