CVE-2015-1042 : Detail

CVE-2015-1042

1.74%V3
Network
2015-02-10
19h00 +00:00
2015-03-05
14h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Products Mentioned

Configuraton 0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.1

Mantisbt>>Mantisbt >> Version 1.2.2

Mantisbt>>Mantisbt >> Version 1.2.3

Mantisbt>>Mantisbt >> Version 1.2.4

Mantisbt>>Mantisbt >> Version 1.2.5

Mantisbt>>Mantisbt >> Version 1.2.6

Mantisbt>>Mantisbt >> Version 1.2.7

Mantisbt>>Mantisbt >> Version 1.2.8

Mantisbt>>Mantisbt >> Version 1.2.9

Mantisbt>>Mantisbt >> Version 1.2.10

Mantisbt>>Mantisbt >> Version 1.2.11

Mantisbt>>Mantisbt >> Version 1.2.12

Mantisbt>>Mantisbt >> Version 1.2.13

Mantisbt>>Mantisbt >> Version 1.2.14

Mantisbt>>Mantisbt >> Version 1.2.15

Mantisbt>>Mantisbt >> Version 1.2.16

Mantisbt>>Mantisbt >> Version 1.2.17

Mantisbt>>Mantisbt >> Version 1.2.18

References

http://www.securitytracker.com/id/1031633
Tags : vdb-entry, x_refsource_SECTRACK
http://www.openwall.com/lists/oss-security/2015/01/10/5
Tags : mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2015/01/11/8
Tags : mailing-list, x_refsource_MLIST
http://seclists.org/fulldisclosure/2015/Jan/110
Tags : mailing-list, x_refsource_FULLDISC