What’s Vulnerable › Vulnerabilities

CVE-2009-2802

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-09 · updated 2026-06-16
• Weakness: CWE-79

Description

MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks.

Affected products

• mantisbt: from 1.2.0 before 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: mantisbt 1.2.2. Check the vendor advisory for mitigations.

References

• https://mantisbt.org/blog/archives/mantisbt/113
• https://mantisbt.org/bugs/view.php?id=11952
• https://security-tracker.debian.org/tracker/CVE-2009-2802
• https://mantisbt.org/blog/archives/mantisbt/113
• https://mantisbt.org/bugs/view.php?id=11952
• https://security-tracker.debian.org/tracker/CVE-2009-2802

Get alerted when CVE-2009-2802 or the next vulnerability affects your stack