mailing list archives
CVE request: MantisBT before 1.2.13 match_type XSS vulnerability
From: David Hicks <d () hx id au>
Date: Fri, 18 Jan 2013 22:31:03 +1100
Jakub Galczyk discovered a cross site scripting (XSS)
vulnerability in MantisBT 1.2.12 and earlier versions that allows a
malicious person to trick the browser of a target user into executing
This vulnerability is particularly wide reaching due to search.php being
usable by anonymous users on public facing installations of MantisBT (no
user account required).
Patches against 1.2.x and master branches are attached and alternatively
available at .
The MantisBT project will release MantisBT 1.2.13 shortly and advise
popular Linux distributions packaging MantisBT to either apply the patch
or bump package versions to 1.2.13.
Can a CVE ID please be assigned to this issue?
Bcc: mantisbt-dev () lists sourceforge net
Description: This is a digitally signed message part
- CVE request: MantisBT before 1.2.13 match_type XSS vulnerability David Hicks (Jan 18)