CVE-2018-6526

2018-02-0209:29:00

Google

osv.dev

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.7%

JSON

view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php.

CPENameOperatorVersion
mantisbteqrelease-2.2.1
mantisbteqrelease-1.3.3
mantisbteqrelease-2.8.0
mantisbteqrelease-1.3.0
mantisbteqrelease-1.3.5
mantisbteqrelease-1.2.0rc1
mantisbteqrelease-2.3.2
mantisbteqrelease-2.0.0-beta.1
mantisbteqrelease-2.0.0-rc.2
mantisbteqrelease-2.10.0

Name	Operator	Version
mantisbt	eq	release-2.2.1
mantisbt	eq	release-1.3.3
mantisbt	eq	release-2.8.0
mantisbt	eq	release-1.3.0
mantisbt	eq	release-1.3.5
mantisbt	eq	release-1.2.0rc1
mantisbt	eq	release-2.3.2
mantisbt	eq	release-2.0.0-beta.1
mantisbt	eq	release-2.0.0-rc.2
mantisbt	eq	release-2.10.0