Security readout for executives and security teams
Plain-English summary
Older MantisBT 1.2.x systems before 1.2.2 may render uploaded attachments too trustingly in the browser. That can let hostile attachment content run in a user’s browser context, creating cross-domain scripting or related browser-side attack risk for issue tracker users.
Executive priority
Treat this as a legacy exposure cleanup item with moderate priority. It is not marked as actively exploited, but affected public or partner-facing issue trackers could expose staff or users to browser-based attacks.
Technical view
The source bundle describes insecure attachment and MIME-type handling in MantisBT 1.2.x before 1.2.2. The risky behavior is arbitrary inline attachment rendering, which can enable cross-domain scripting or other browser attacks. The bundle does not provide CVSS, CWE, exploit maturity, or detailed patch mechanics.
Likely exposure
Exposure is most likely in legacy MantisBT 1.2.x deployments before 1.2.2, especially issue trackers that allow users to upload and view attachments. Public-facing trackers or trackers used by external reporters carry higher practical risk.
Exploitation context
The bundle does not show active exploitation, and KEV is false. The attack class is browser-side: a malicious or unsafe attachment could be rendered inline and affect users who view it through the tracker.
Researcher notes
Evidence is sparse. The key facts are affected range, attachment/MIME handling weakness, and the stated browser attack impact. No CVSS, CWE, exploit status, or detailed fix notes are present in the provided bundle.
Mitigation direction
- Inventory MantisBT deployments and confirm exact versions.
- Upgrade affected MantisBT 1.2.x instances to 1.2.2 or later.
- Review MantisBT vendor guidance before changing attachment behavior.
- Restrict untrusted attachment access where upgrade timing is delayed.
- Retire unsupported legacy MantisBT systems where feasible.
Validation and detection
- Check application banners, package metadata, or deployment records for MantisBT version.
- Confirm no production instance runs MantisBT 1.2.x before 1.2.2.
- Review tracker configuration for inline attachment rendering exposure.
- Check access logs for unusual attachment viewing patterns.
- Verify remediation in a test environment before production rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2009-2802 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://security-tracker.debian.org/tracker/CVE-2009-2802CVE reference · x_refsource_MISC
- https://mantisbt.org/blog/archives/mantisbt/113CVE reference · x_refsource_CONFIRM
- https://mantisbt.org/bugs/view.php?id=11952CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.