CVE-2011-3356: XSS
A local file inclusion/path traversal vulnerability and XSS flaw was found in the Mantis bug tracker version 1.2.7 [1],[2].
[1] https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html [2] https://github.com/mantisbt/mantisbt/commit/a7eacc181185eff1dd7bd8ceaa34a91cf86cc298
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to (1) manageconfigemailpage.php, (2) manageconfigworkflowpage.php, or (3) bugs/plugin.php.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3356?
CVE-2011-3356 is classified as a medium severity vulnerability due to its local file inclusion and XSS characteristics.
How do I fix CVE-2011-3356?
To mitigate CVE-2011-3356, upgrade Mantis Bug Tracker to version 1.2.8 or later.
What versions are affected by CVE-2011-3356?
CVE-2011-3356 affects Mantis Bug Tracker versions up to and including 1.2.7.
What types of vulnerabilities does CVE-2011-3356 include?
CVE-2011-3356 includes both local file inclusion and cross-site scripting vulnerabilities.
Is there a workaround for CVE-2011-3356 if I cannot upgrade?
A temporary workaround for CVE-2011-3356 may involve restricting access to the affected components, but upgrading is strongly recommended.