Em resumo
- CVE-2017-7620 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta mantisbt/mantisbt, mantisbt (mantisbt).
- Chance de exploração nos próximos 30 dias (EPSS): 1.4%, maior que 71.7% das vulnerabilidades.
- Correção: atualize para 2.3.3, 2.4.1, 1.3.11 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.0.0, < 2.3.3≥ 2.4.0, < 2.4.1< 1.3.11
| 2.3.32.4.11.3.11
|
| mantisbt | = 2.0.0= 2.0.1= 2.1.0= 2.1.1= 2.1.2= 2.2.0= 2.2.2= 2.2.3= 2.2.4= 2.4.0≤ 1.3.10
| No fix yet |
Description
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial / substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
NVD description
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Mais vulnerabilidades de mantisbt/mantisbt
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free