Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting
The advisory, in context
Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when:
- resolving or closing issues (bug_change_status_page.php) belonging to a project linking said custom field
- viewing issues (view_all_bug_page.php) when the custom field is displayed as a column
- printing issues (print_all_bug_page.php) when the custom field is displayed as a column
Impact
Cross-site scripting (XSS).
Patches
https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739be
Workarounds
Ensure Custom Field Names do not contain HTML tags.
References
- https://mantisbt.org/bugs/view.php?id=34432
- This is related to CVE-2020-25830 (same root cause, different affected pages)
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.26.2
Fixed in 2.26.2
67 explicitly affected versions
2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 2.12.2, 2.13.0, 2.13.1, 2.13.2, 2.14.0, 2.15.0, 2.15.1, 2.16.0, 2.16.1, 2.17.0, 2.17.1, 2.17.2, 2.18.0, 2.18.1, 2.19.0, 2.19.1, 2.20.0, 2.20.1, 2.21.0, 2.21.1, 2.21.2, 2.21.3, 2.22.0, 2.22.1, 2.22.2, 2.23.0, 2.23.1, 2.24.0, 2.24.1, 2.24.2, 2.24.3, 2.24.4, 2.24.5, 2.25.0, 2.25.1, 2.25.2, 2.25.3, 2.25.4, 2.25.5, 2.25.6, 2.25.7, 2.25.8, 2.26.0, 2.26.1, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.26.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.10.0",
"2.10.1",
"2.11.0",
"2.11.1",
"2.12.0",
"2.12.1",
"2.12.2",
"2.13.0",
"2.13.1",
"2.13.2",
"2.14.0",
"2.15.0",
"2.15.1",
"2.16.0",
"2.16.1",
"2.17.0",
"2.17.1",
"2.17.2",
"2.18.0",
"2.18.1",
"2.19.0",
"2.19.1",
"2.20.0",
"2.20.1",
"2.21.0",
"2.21.1",
"2.21.2",
"2.21.3",
"2.22.0",
"2.22.1",
"2.22.2",
"2.23.0",
"2.23.1",
"2.24.0",
"2.24.1",
"2.24.2",
"2.24.3",
"2.24.4",
"2.24.5",
"2.25.0",
"2.25.1",
"2.25.2",
"2.25.3",
"2.25.4",
"2.25.5",
"2.25.6",
"2.25.7",
"2.25.8",
"2.26.0",
"2.26.1",
"2.3.0",
"2.3.1",
"2.3.2",
"2.3.3",
"2.4.0",
"2.4.1",
"2.4.2",
"2.5.0",
"2.5.1",
"2.5.2",
"2.6.0",
"2.7.0",
"2.7.1",
"2.8.0",
"2.8.1",
"2.9.0",
"2.9.1"
]
}