CVE-2018-6382

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-6382

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6382.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-6382

Published

2018-01-30T06:29:00.320Z

Modified

2026-07-08T20:04:48.283343Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass

References

Affected packages

Git / github.com/mantisbt/mantisbt

Affected ranges

Type

GIT

Repo

https://github.com/mantisbt/mantisbt

Events

Introduced

9717433ba87f758c57a53e22f533f6d252adb624

Last affected

9717433ba87f758c57a53e22f533f6d252adb624

Database specific

{
    "cpe": "cpe:2.3:a:mantisbt:mantisbt:2.10.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.10.0"
        },
        {
            "last_affected": "2.10.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.10.0

release-2.*

release-2.10.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6382.json"