CVE-2013-1883: Input Validation
A denial of service flaw was found in the way MantisBT, a free popular web-based issue tracking system, performed processing of certain type of View Issues page search queries. A remote attacker could provide a specially-crafted query (filter combining some criteria and a text search with 'any condition') that, when processed by the MantisBT system, would lead to excessive system resources consumption (denial of service), possibly leading to complete MantisBT server instance unavailability.
References: [1] http://www.openwall.com/lists/oss-security/2013/03/21/3
Upstream bug report: [2] http://www.mantisbt.org/bugs/view.php?id=15573
Relevant upstream patch: [3] https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7
Other sources
Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1883?
CVE-2013-1883 has been classified as a moderate severity denial of service vulnerability.
How do I fix CVE-2013-1883?
To fix CVE-2013-1883, upgrade MantisBT to version 1.2.15 or later.
What versions of MantisBT are affected by CVE-2013-1883?
CVE-2013-1883 affects MantisBT versions 1.2.12, 1.2.13, and 1.2.14.
Can CVE-2013-1883 be exploited remotely?
Yes, CVE-2013-1883 can be exploited remotely by an attacker sending a specially-crafted query to the View Issues page.
What type of vulnerability is CVE-2013-1883?
CVE-2013-1883 is a denial of service vulnerability that can disrupt the functioning of MantisBT.