Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 21 Jan 2013 09:07:59 +0000 (UTC)
From: Damien Regad <>
Subject: Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability

Kurt Seifried <kseifried@...> writes:
> Please use CVE-2013-0197 for this issue.

Hi Kurt,

Thanks for creating the CVE; please take note of a small rectification on the
original issue report:

David Hicks <d <at>> writes:
> Jakub Galczyk discovered[1][2] a cross site scripting (XSS)
> vulnerability in *MantisBT 1.2.12 and earlier versions* 

This affects *only MantisBT version 1.2.12* (and the 'master'
development branch after 15-Sep-2012), as earlier versions did not contain the
commit introducing the 'match type' filtering feature [1].

It's also worth mentioning that a better patch for the vulnerability is
available under follow-up issue #15388 [2]

Damien Regad
MantisBT developer

[1] 1.2.x branch:
    master branch:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.