core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to login_page.php.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2014-12-12T11:00:00
Updated: 2024-08-06T12:10:13.283Z
Reserved: 2014-09-11T00:00:00
Link: CVE-2014-6316
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-12-12T11:59:03.610
Modified: 2017-09-08T01:29:13.967
Link: CVE-2014-6316
Redhat
No data.