Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:PHP:MANTIS-BT-ORDR |
|---|---|
Severity |
Minor |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Mantis Bug Tracker Open Redirect |
Release Date |
2019/05/20 |
Update Number |
3173 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Mantis Bug Tracker Open Redirect
This signature detects attempts to exploit a known vulnerability against mantis bug tracker. A successful attack can lead to open redirection.
Extended Description
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Affected Products
- Mantisbt mantisbt 1.3.10
- Mantisbt mantisbt 2.0.0
- Mantisbt mantisbt 2.0.1
- Mantisbt mantisbt 2.1.0
- Mantisbt mantisbt 2.1.1
- Mantisbt mantisbt 2.1.2
- Mantisbt mantisbt 2.2.0
- Mantisbt mantisbt 2.2.2
- Mantisbt mantisbt 2.2.3
- Mantisbt mantisbt 2.2.4
- Mantisbt mantisbt 2.4.0
References