CVE-2013-1934

A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
VendorProductVersion
mantisbtmantisbt
1.2.1 ≤
𝑥
≤ 1.2.14
mantisbtmantisbt
1.2.0
mantisbtmantisbt
1.2.0:rc1
mantisbtmantisbt
1.2.0:rc2
debiandebian_linux
7.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mantis
zesty
dne
yakkety
dne
xenial
dne
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
ignored
raring
ignored
quantal
ignored
precise
ignored
oneiric
ignored
lucid
ignored
hardy
ignored
Common Weakness Enumeration
References
http://www.debian.org/security/2015/dsa-3120
http://www.openwall.com/lists/oss-security/2013/04/09/1
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1934
https://mantisbt.org/bugs/view.php?id=15416
https://security-tracker.debian.org/tracker/CVE-2013-1934
http://www.debian.org/security/2015/dsa-3120
http://www.openwall.com/lists/oss-security/2013/04/09/1
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1934
https://mantisbt.org/bugs/view.php?id=15416
https://security-tracker.debian.org/tracker/CVE-2013-1934