CVE-2010-3303

Published: Oct 5, 2010Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php.

Affected (38)

Products: Mantisbt: Mantisbt

1 product

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Mantisbt Mantisbt	Up to 1.2.2
Mantisbt Mantisbt	Version 0.18.0
Mantisbt Mantisbt	Version 0.19.0
Mantisbt Mantisbt	Version 0.19.0 rc1
Mantisbt Mantisbt	Version 0.19.0a1
Mantisbt Mantisbt	Version 0.19.0a2
Mantisbt Mantisbt	Version 0.19.1
Mantisbt Mantisbt	Version 0.19.2
Mantisbt Mantisbt	Version 0.19.3
Mantisbt Mantisbt	Version 0.19.4
Mantisbt Mantisbt	Version 0.19.5
Mantisbt Mantisbt	Version 1.0.0
Mantisbt Mantisbt	Version 1.0.0 rc1
Mantisbt Mantisbt	Version 1.0.0 rc2
Mantisbt Mantisbt	Version 1.0.0 rc3
Mantisbt Mantisbt	Version 1.0.0 rc4
Mantisbt Mantisbt	Version 1.0.0 rc5
Mantisbt Mantisbt	Version 1.0.0a1
Mantisbt Mantisbt	Version 1.0.0a2
Mantisbt Mantisbt	Version 1.0.0a3
Mantisbt Mantisbt	Version 1.0.1
Mantisbt Mantisbt	Version 1.0.2
Mantisbt Mantisbt	Version 1.0.3
Mantisbt Mantisbt	Version 1.0.4
Mantisbt Mantisbt	Version 1.0.5
Mantisbt Mantisbt	Version 1.0.6
Mantisbt Mantisbt	Version 1.0.7
Mantisbt Mantisbt	Version 1.0.8
Mantisbt Mantisbt	Version 1.1.0
Mantisbt Mantisbt	Version 1.1.1
Mantisbt Mantisbt	Version 1.1.2
Mantisbt Mantisbt	Version 1.1.4
Mantisbt Mantisbt	Version 1.1.5
Mantisbt Mantisbt	Version 1.1.6
Mantisbt Mantisbt	Version 1.1.7
Mantisbt Mantisbt	Version 1.1.8
Mantisbt Mantisbt	Version 1.2.0
Mantisbt Mantisbt	Version 1.2.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (34)

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048548.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048639.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048659.html

Source: secalert@redhat.com

http://secunia.com/advisories/41653

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/51199

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201211-01.xml

Source: secalert@redhat.com

http://www.mantisbt.org/bugs/changelog_page.php?version_id=111

Source: secalert@redhat.com

http://www.mantisbt.org/bugs/view.php?id=12231

Source: secalert@redhat.com

http://www.mantisbt.org/bugs/view.php?id=12232

Source: secalert@redhat.com

http://www.mantisbt.org/bugs/view.php?id=12234

Source: secalert@redhat.com

http://www.mantisbt.org/bugs/view.php?id=12238

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/09/14/12

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/09/14/13

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/09/14/19

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/09/16/16

Source: secalert@redhat.com

http://www.securityfocus.com/bid/43604

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2535

Source: secalert@redhat.com

Vendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048548.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048639.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048659.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/41653

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/51199

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-201211-01.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mantisbt.org/bugs/changelog_page.php?version_id=111

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mantisbt.org/bugs/view.php?id=12231

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mantisbt.org/bugs/view.php?id=12232

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mantisbt.org/bugs/view.php?id=12234

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mantisbt.org/bugs/view.php?id=12238

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/09/14/12

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/09/14/13

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/09/14/19

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/09/16/16

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/43604

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2535

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.