Lucene search

[email protected]NVD:CVE-2014-9272

HistoryJan 09, 2015 - 6:59 p.m.

CVE-2014-9272

2015-01-0918:59:03

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.004

Percentile

72.7%

JSON

The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.

Affected configurations

Nvd

Node

debiandebian_linuxMatch7.0

Node

mantisbtmantisbtMatch1.1.0a1

mantisbtmantisbtMatch1.1.0a2

mantisbtmantisbtMatch1.1.0a3

mantisbtmantisbtMatch1.1.0a4

mantisbtmantisbtMatch1.1.0rc1

mantisbtmantisbtMatch1.1.0rc2

mantisbtmantisbtMatch1.1.0rc3

mantisbtmantisbtMatch1.1.1

mantisbtmantisbtMatch1.1.2

mantisbtmantisbtMatch1.1.3

mantisbtmantisbtMatch1.1.4

mantisbtmantisbtMatch1.1.5

mantisbtmantisbtMatch1.1.6

mantisbtmantisbtMatch1.1.7

mantisbtmantisbtMatch1.1.8

mantisbtmantisbtMatch1.1.9

mantisbtmantisbtMatch1.2.0

mantisbtmantisbtMatch1.2.0alpha1

mantisbtmantisbtMatch1.2.0alpha2

mantisbtmantisbtMatch1.2.0alpha3

mantisbtmantisbtMatch1.2.0rc1

mantisbtmantisbtMatch1.2.0rc2

mantisbtmantisbtMatch1.2.1

mantisbtmantisbtMatch1.2.2

mantisbtmantisbtMatch1.2.3

mantisbtmantisbtMatch1.2.4

mantisbtmantisbtMatch1.2.5

mantisbtmantisbtMatch1.2.6

mantisbtmantisbtMatch1.2.7

mantisbtmantisbtMatch1.2.8

mantisbtmantisbtMatch1.2.9

mantisbtmantisbtMatch1.2.10

mantisbtmantisbtMatch1.2.11

mantisbtmantisbtMatch1.2.12

mantisbtmantisbtMatch1.2.13

mantisbtmantisbtMatch1.2.14

mantisbtmantisbtMatch1.2.15

mantisbtmantisbtMatch1.2.16

mantisbtmantisbtMatch1.2.17

VendorProductVersionCPE
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:a1:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:a2:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:a3:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:a4:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc1:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc2:*:*:*:*:*:*
mantisbtmantisbt1.1.0cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc3:*:*:*:*:*:*
mantisbtmantisbt1.1.1cpe:2.3:a:mantisbt:mantisbt:1.1.1:*:*:*:*:*:*:*
mantisbtmantisbt1.1.2cpe:2.3:a:mantisbt:mantisbt:1.1.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
debian	debian_linux	7.0	cpe:2.3:o:debian:debian_linux:7.0:::::::*
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:a1::::::
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:a2::::::
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:a3::::::
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:a4::::::
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc1::::::
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc2::::::
mantisbt	mantisbt	1.1.0	cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc3::::::
mantisbt	mantisbt	1.1.1	cpe:2.3:a:mantisbt:mantisbt:1.1.1:::::::*
mantisbt	mantisbt	1.1.2	cpe:2.3:a:mantisbt:mantisbt:1.1.2:::::::*