CVE

Id
78319  
CVE No.
CVE-2015-1042  
Status
Candidate  
Description
The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.  
Phase
Assigned (20150111)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
715180 78319 CVE-2015-1042 FULLDISC:20150128 CVE-2015-1042 - Mantis BugTracker 1.2.19 - URL Redirection to Untrusted Site ("Open Redirect")  View
715181 78319 CVE-2015-1042 URL:http://seclists.org/fulldisclosure/2015/Jan/110  View
715182 78319 CVE-2015-1042 MLIST:[oss-security] 20150110 Re: CVE-2014-6316: URL redirection issue in MantisBT  View
715183 78319 CVE-2015-1042 URL:http://www.openwall.com/lists/oss-security/2015/01/10/5  View
715184 78319 CVE-2015-1042 MLIST:[oss-security] 20150111 Re: Re: CVE-2014-6316: URL redirection issue in MantisBT  View
715185 78319 CVE-2015-1042 URL:http://www.openwall.com/lists/oss-security/2015/01/11/8  View
715186 78319 CVE-2015-1042 MISC:http://packetstormsecurity.com/files/130142/Mantis-BugTracker-1.2.19-Open-Redirect.html  View
715187 78319 CVE-2015-1042 CONFIRM:https://www.mantisbt.org/bugs/view.php?id=17997  View
715188 78319 CVE-2015-1042 SECTRACK:1031633  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
6851 JVNDB-2015-002171 Apple iOS および Apple TV の IOAcceleratorFamily におけるカーネルメモリに関する重要な情報を取得される脆弱性 Apple iOS および Apple TV の IOAcceleratorFamily には、カーネルメモリに関する重要な情報を取得される脆弱性が存在します。 CVE-2015-1094 78319 1.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002171.html  View