CVE-2011-3356

MantisBT < 1.2.8 - Cross-Site Scripting via PATH_INFO

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php.

References (16)

Core 16
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8392
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/09/04/1
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201211-01.xml
Exploit, Patch x_refsource_confirm
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297
Exploit, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=735514
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49448
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51199
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69587
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/09/09/9
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/519547/100/0/threaded

Scores

EPSS 0.0182
EPSS Percentile 76.3%

Details

CWE
CWE-79
Status published
Products (27)
mantisbt/mantisbt 0.19.3
mantisbt/mantisbt 0.19.4
mantisbt/mantisbt 1.0.0
mantisbt/mantisbt 1.0.1
mantisbt/mantisbt 1.0.2
mantisbt/mantisbt 1.0.3
mantisbt/mantisbt 1.0.4
mantisbt/mantisbt 1.0.5
mantisbt/mantisbt 1.0.6
mantisbt/mantisbt 1.0.7
... and 17 more
Published Sep 21, 2011
Tracked Since Feb 18, 2026