MantisBT CSV Injection unprivileged user access in csv_export.php

높음 7.8CVE-2021-43257 · GHSA-rg8f-5p7x-m6wv · Published 14/04/2022 · updated 17/06/2026

요약

CVE-2021-43257은(는) mantisbt/mantisbt, mantisbt (mantisbt)에 영향을 주는 높음 (CVSS 7.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.98%, 전체 취약점의 62.2%보다 높음.
조치: 2.25.3 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.25.3`	`2.25.3`
mantisbt mantisbt	`< 2.25.3`	`2.25.3`

Description

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-43257 · ADVISORY
mantisbt/mantisbt commit 7f4534c · WEB
mantisbt/mantisbt commit 99eb8d4 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

mantisbt/mantisbt의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mantisbt/mantisbt

Packagist

< 2.25.3

2.25.3

mantisbt

< 2.25.3

2.25.3

Description

NVD description

mantisbt/mantisbt의 다른 취약점

모두 보기 →