Back to search
CVE-2014-9272
Published: Jan 9, 2015
Modified: Aug 6, 2024
PUBLISHED
Description
The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://github.com/mantisbt/mantisbt/commit/05378e00
x_refsource_CONFIRM
https://www.mantisbt.org/bugs/view.php?id=17297
x_refsource_CONFIRM
62101
third-party-advisory
x_refsource_SECUNIA
[oss-security] 20141201 CVE Request: Multiple XSS vulnerabilities in MantisBT
mailing-list
x_refsource_MLIST
[oss-security] 20141204 Re: CVE Request: Multiple XSS vulnerabilities in MantisBT
mailing-list
x_refsource_MLIST
DSA-3120
vendor-advisory
x_refsource_DEBIAN
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now