Security Advisory

CVE-2014-6316

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2014-12-12 11:00:00

Last updated 2024-08-06 12:10:13

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to login_page.php.

← Browse all CVEs View on cve.org ↗