CVE-2010-2574

EPSS 0.42%
Published 10.08.2010 12:23:06
Last modified 11.04.2025 00:51:21
Source PSIRT-CNA@flexerasoftware.com
Teams watchlist Login
Open Login

Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action.

Affected products Warnungen 0 Metrics 2 CWE 1 References 15

Data is provided by the National Vulnerability Database (NVD)

Mantisbt ≫ Mantisbt Version1.2.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.42%	0.591

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	2.1	3.9	2.9	AV:N/AC:H/Au:S/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048548.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048639.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048659.html

http://secunia.com/advisories/40832

Vendor Advisory

http://secunia.com/advisories/41653

http://secunia.com/secunia_research/2010-103/

Vendor Advisory

http://www.mantisbt.org/bugs/changelog_page.php?version_id=111

http://www.mantisbt.org/bugs/view.php?id=12230

http://www.openwall.com/lists/oss-security/2010/09/14/12

http://www.openwall.com/lists/oss-security/2010/09/14/13