CVE-2013-0197

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-15 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php.

Affected products

mantisbt: 1.2.12, 1.2.13

References

http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html
http://seclists.org/oss-sec/2013/q1/118
http://seclists.org/oss-sec/2013/q1/125
http://seclists.org/oss-sec/2013/q1/140
http://secunia.com/advisories/51853
http://www.mantisbt.org/bugs/view.php?id=15373
http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html
http://seclists.org/oss-sec/2013/q1/118
http://seclists.org/oss-sec/2013/q1/125
http://seclists.org/oss-sec/2013/q1/140
http://secunia.com/advisories/51853
http://www.mantisbt.org/bugs/view.php?id=15373

Get alerted when CVE-2013-0197 or the next vulnerability affects your stack