CVE-2013-1810 - Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function

Back Back to CVE browser

LOW

Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function

Published May 15, 2014

2.1

LOW

CVSS 2.0

EPSS 0.96%

Description

Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

http://seclists.org/oss-sec/2013/q1/127
mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2013/q1/556
mailing-listx_refsource_MLIST
http://secunia.com/advisories/51853
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.mantisbt.org/bugs/view.php?id=15384
x_refsource_CONFIRM
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-1831
Advisory

Link	Providers	Tags
http://seclists.org/oss-sec/2013/q1/127		mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2013/q1/556		mailing-listx_refsource_MLIST
http://secunia.com/advisories/51853		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.mantisbt.org/bugs/view.php?id=15384		x_refsource_CONFIRM
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-1831		Advisory