PT-2011-4403

CVE-2011-3357

·

Publicado

2011-09-21

·

Atualizado

2018-10-09

Descrição por

CVSS 2.0
6.8
Média
MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.8
Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter. This is related to the bug actiongroup page.php file.
Recommendations For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the bug actiongroup ext page.php file until a patch is applied. Avoid using the action parameter in the affected page until the issue is resolved.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Identificadores relacionados
CVE-2011-3357
DSA-2308-1
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com