Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS)

[Nico Golde <oss-security+ml () ngolde de>]

Hi,
* David Hicks <d () hx id au> [2011-09-04 16:11]:
> On Sun, 2011-09-04 at 15:18 +1000, David Hicks wrote:
> > Request #2: LFI and XSS via bug_actiongroup_ext_page.php
>
> I don't think my earlier message conveyed the severity of this bug well
> enough.
>
> MantisBT allows users to upload attachments to bug reports. These
> attachments are commonly stored on the disk in an 'attachments'
> directory that should be stored outside the web root (but are still
> accessible to MantisBT for retrieval).
[...]
In case this slipped through the cracks... Can someone assign ids to these 
issues?

Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: