Dependency Graph

View IssueRelationship GraphVerticalShow Summary
Dependency Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0019275mantisbtsecuritypublic2015-01-27 04:492015-03-15 19:58
Reporterdregad Assigned Todregad  
PriorityurgentSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version1.3.0-beta.1 
Target Version1.3.0-beta.2Fixed in Version1.3.0-beta.2 
Summary0019275: CVE-2015-1042: URL redirection issue
Description

This is a clone of 0017997 to track the vulnerability in 1.3.x branch

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
duplicate of 0017997 closeddregad CVE-2015-1042: URL redirection issue 

Activities

There are no notes attached to this issue.

Related Changesets

MantisBT: master e7e2b550

2015-01-10 12:25

dregad


Details Diff		 Fix URL redirection issue in login_page.php

The fix for issue 0017648 failed to correct all cases of redirection.

Alejo Popovici discovered that the regex checking for URLs pointing to
other domains considered an URL with a single '/' as local, allowing
redirection e.g. to http:/google.com on certain browsers.

Fixes 0017997 (CVE-2015-1042)		 Affected Issues
0017648, 0017997, 0019275
mod - core/string_api.php Diff File