GHSA-j3v9-553h-x28j — MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

The advisory, in context

Any authenticated user can inject arbitrary HTML via updating their account's font family.

Impact

Cross-site scripting. The injected payload will be reflected in every MantisBT page.

Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover.

Patches

9e8409cdd979eba86ef532756fc47c1d8112d22d

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

mantisbt/mantisbt Packagist

Ecosystem versions

From 2.11.0 before 2.28.2

Fixed in 2.28.2

57 explicitly affected versions

2.11.0, 2.11.1, 2.12.0, 2.12.1, 2.12.2, 2.13.0, 2.13.1, 2.13.2, 2.14.0, 2.15.0, 2.15.1, 2.16.0, 2.16.1, 2.17.0, 2.17.1, 2.17.2, 2.18.0, 2.18.1, 2.19.0, 2.19.1, 2.20.0, 2.20.1, 2.21.0, 2.21.1, 2.21.2, 2.21.3, 2.22.0, 2.22.1, 2.22.2, 2.23.0, 2.23.1, 2.24.0, 2.24.1, 2.24.2, 2.24.3, 2.24.4, 2.24.5, 2.25.0, 2.25.1, 2.25.2, 2.25.3, 2.25.4, 2.25.5, 2.25.6, 2.25.7, 2.25.8, 2.26.0, 2.26.1, 2.26.2, 2.26.3, 2.26.4, 2.27.0, 2.27.1, 2.27.2, 2.27.3, 2.28.0, 2.28.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.11.0"
        },
        {
          "fixed": "2.28.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.11.0",
    "2.11.1",
    "2.12.0",
    "2.12.1",
    "2.12.2",
    "2.13.0",
    "2.13.1",
    "2.13.2",
    "2.14.0",
    "2.15.0",
    "2.15.1",
    "2.16.0",
    "2.16.1",
    "2.17.0",
    "2.17.1",
    "2.17.2",
    "2.18.0",
    "2.18.1",
    "2.19.0",
    "2.19.1",
    "2.20.0",
    "2.20.1",
    "2.21.0",
    "2.21.1",
    "2.21.2",
    "2.21.3",
    "2.22.0",
    "2.22.1",
    "2.22.2",
    "2.23.0",
    "2.23.1",
    "2.24.0",
    "2.24.1",
    "2.24.2",
    "2.24.3",
    "2.24.4",
    "2.24.5",
    "2.25.0",
    "2.25.1",
    "2.25.2",
    "2.25.3",
    "2.25.4",
    "2.25.5",
    "2.25.6",
    "2.25.7",
    "2.25.8",
    "2.26.0",
    "2.26.1",
    "2.26.2",
    "2.26.3",
    "2.26.4",
    "2.27.0",
    "2.27.1",
    "2.27.2",
    "2.27.3",
    "2.28.0",
    "2.28.1"
  ]
}

Set up in your agent.

Investigate in your agent.