GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-f633-865q-2mhhhigh7.5

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

Impact

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

mantisbt/mantisbt Packagist
Affected rangeRecorded fix
From 2.1.0 before 2.28.2Ecosystem versions2.28.2

Version evidence: OSV · GHSA-f633-865q-2mhh

View original version evidence (76 explicit versions)

Original source description

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.

Impact

Cross-site scripting (XSS).

Note that By default, only users with Manager access level or above can save their filters publicly

Patches

  • 44f490bcf20fd491c1b8f3fc9dd041d8c2a30010

Workarounds

  • Prevent display of users' real name (set $g_ show_user_realname = OFF; in configuration)
  • Restrict ability to store filters (set $g_stored_query_create_threshold / $g_stored_query_create_shared_threshold to NOBODY

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

References