Skip to content
Fencer Intel
medium 5.1

CVE-2010-4350 json

Directory traversal vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute a…

published 15y ago modified 4mo ago also EUVD-2010-4319

cvss
5.1
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.9%
EPSS 7.9% chance of exploitation in 30 days, percentile 94%
public exploits
1
Exploit-DB

Summary

Directory traversal vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the db_type parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.

Patch / fix

Is CVE-2010-4350 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2010-4350 updated cvss 4.0

MantisBT <1.2.4 multiple vulnerabilities (LFI, XSS and PD)

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-15736)
  2. Published

Exploit prediction

7.88% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-15736 Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion webapps, 2010-12-15
  • openwall.com http://openwall.com/lists/oss-security/2010/12/15/5 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://openwall.com/lists/oss-security/2010/12/16/2 referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=663230 referenced PoC, tagged "exploit" by a source, unverified
  • zeroscience.mk http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php referenced PoC, tagged "exploit" by a source, unverified
  • mantisbt.org http://www.mantisbt.org/bugs/changelog_page.php?version_id=112 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.