MantisBT 'filter_api.php' Denial of Service Vulnerability

Bugtraq ID:	58626
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-1883
Remote:	Yes
Local:	No
Published:	Mar 21 2013 12:00AM
Updated:	May 07 2015 05:06PM
Credit:	jjtest
Vulnerable:
Not Vulnerable:

MantisBT 'filter_api.php' Denial of Service Vulnerability

MantisBT is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected application to crash, denying service to legitimate users.

MantisBT 1.2.12 through 1.2.14 are vulnerable; other versions may also be affected.

MantisBT 'filter_api.php' Denial of Service Vulnerability

An attacker can exploit this issue using a web browser.

MantisBT 'filter_api.php' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MantisBT 'filter_api.php' Denial of Service Vulnerability

References:

• 0015573: One query can be issued via current Mantis interface to take down site (Mantis)
  
• CVE request: MantisBT text search query can crash site (jjtest)
  
• Fix filter api issue with 'any condition' and text search (GitHub Inc.)
  
• Mantis Homepage Mantis (Matis)