CVE-2014-6316

core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open…

published December 12, 2014

CVSS
—
EPSS
2%
Percentile
83.3
In the wild
Unconfirmed
What it is

core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to login_page.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02328 · 83.3th percentile
Published
2014-12-12T11:00Z
EPSS history
Timeline
  • 12 DEC 11:00Z
    core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open…
    cvelistv5