CVE-2013-1810

Published: 15 May 2014

Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.

Notes

only 1.2.12 was affected

Status

References

• http://www.openwall.com/lists/oss-security/2013/03/03/7
• https://www.cve.org/CVERecord?id=CVE-2013-1810
• NVD
• Launchpad
• Debian