The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-02-10T20:00:00

Updated: 2024-08-06T04:33:20.326Z

Reserved: 2015-01-11T00:00:00

Link: CVE-2015-1042

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2015-02-10T20:59:00.060

Modified: 2024-11-21T02:24:31.740

Link: CVE-2015-1042

cve-icon Redhat

No data.