CVE-2011-3357

2011-09-2100:00:00

ubuntu.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.01 Low

EPSS

Percentile

83.5%

JSON

Directory traversal vulnerability in bug_actiongroup_ext_page.php in
MantisBT before 1.2.8 allows remote attackers to include and execute
arbitrary local files via a … (dot dot) in the action parameter, related
to bug_actiongroup_page.php.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu11.04noarchmantis< 1.1.8+dfsg-10squeeze2UNKNOWN
ubuntu11.10noarchmantis< 1.2.8-1UNKNOWN
ubuntu12.04noarchmantis< 1.2.8-1UNKNOWN
ubuntu12.10noarchmantis< 1.2.8-1UNKNOWN
ubuntu13.04noarchmantis< 1.2.8-1UNKNOWN
ubuntu13.10noarchmantis< 1.2.8-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	11.04	noarch	mantis	< 1.1.8+dfsg-10squeeze2	UNKNOWN
ubuntu	11.10	noarch	mantis	< 1.2.8-1	UNKNOWN
ubuntu	12.04	noarch	mantis	< 1.2.8-1	UNKNOWN
ubuntu	12.10	noarch	mantis	< 1.2.8-1	UNKNOWN
ubuntu	13.04	noarch	mantis	< 1.2.8-1	UNKNOWN
ubuntu	13.10	noarch	mantis	< 1.2.8-1	UNKNOWN