What is CVE-2018-6382?

CVE-2018-6382 is a low-severity vulnerability in Mantisbt, classified under SQL Injection. CVSS score: 3.3/10. Published 2018-01-30.

How severe is CVE-2018-6382?

Low severity. CVSS v3 base score is 3.3 out of 10.

SQL Injection in Mantisbt

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass

Vulnerability class: SQL Injection

EPSS: 0.005 (41.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mantisbt — versions 2.10.0
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2018-6382?: CVE-2018-6382 is a low-severity vulnerability in Mantisbt, classified under SQL Injection. CVSS score: 3.3/10. Published 2018-01-30.
How severe is CVE-2018-6382?: Low severity. CVSS v3 base score is 3.3 out of 10.