CVE-2020-28413
MEDIUM 6.5EPSS 4.8%
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS v3.1 MITRE
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 4.0 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N - EPSS
- 4.78% chance of exploitation in the next 30 days, 92nd percentile
- Published
- 2020-12-30
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/160750/Mantis-Bug-Tracker-2.24.3-SQL-Injection.html
- EthicalHCOP/CVE-2020-28413_Mantis2.24.3-SQLi-SOAP0★ · 2020-12-30
ExploitDB entries (1)
Security advisories
- https://ethicalhcop.medium.com/cve-2020-28413-blind-sql-injection-en-mantis-bug-tracker-2…
- advisories/GHSA-49w9-82cj-xr48