[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130301183137.GA29447@elende>
Date: Fri, 1 Mar 2013 19:31:37 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Roland Becker <roland@...ol.de>,
Robert Munteanu <robert.munteanu@...il.com>
Subject: Re: CVE request: MantisBT 1.2.12 only summary.php
category/project names XSS vulnerability
Hi Kurt
Noticed that this ruequest did not got a CVE. Can one be assigned?
Note that this only seems to affect exactly one version 1.2.12:
On Sat, Jan 19, 2013 at 10:21:11AM +1100, David Hicks wrote:
> Hi list,
>
> Roland Becker (MantisBT Developer) discovered[1] a XSS vulnerability
> introduced in MantisBT 1.2.12 with the display of category/project names
> on the summary.php page. Versions of MantisBT other than 1.2.12 are not
> affected by this vulnerability.
>
> A malicious MantisBT user holding privileged manager/administrator
> permissions could create a category or project name that contains
> JavaScript code. Any user visiting summary.php from that point on may
> then be exposed to having the malicious JavaScript execute within their
> browser environment.
>
> The severity of this issue is limited by the need to hold privileged
> manager/administrator permissions in order to modify category and
> project names. However -- there are many use cases where MantisBT
> installations can have hundreds of sub-projects, each managed by
> different people/parties that can not or should not be fully trusted.
>
> Refer to previous commits 3ca8a164[2] and 6ec3f693[3] to trace back the
> origin of this vulnerability.
>
> References:
> [1] http://www.mantisbt.org/bugs/view.php?id=15384
> [2]
> https://github.com/mantisbt/mantisbt/commit/3ca8a164641951aba2a459364e656ca0996f8a2b
> [3]
> https://github.com/mantisbt/mantisbt/commit/6ec3f693d6d212d6bba788681a206c14df43569f
>
> Discussion on the MantisBT Developer Mailing List has indicated that a
> release of MantisBT 1.2.13 (resolving both this vulnerability and
> CVE-2013-0197 which was announced on this list ~12 hours ago) will not
> occur until early next week. As such, a patch is attached for
> distributions packaging MantisBT 1.2.12. It is recommended this patch be
> applied as soon as possible.
>
> Can a CVE ID please be assigned to this issue?
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
