PT-2018-14193 · Mantisbt · Mantisbt

Atrol + 1 · Publicado 2018-10-30 · Atualizado 2022-05-14 · CVE-2018-17782

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 2.1.0 through 2.17.1

Description A cross-site scripting issue in the Manage Filters page allows remote attackers to inject arbitrary code through a crafted project name, provided access rights and CSP settings permit it.

Recommendations For versions 2.1.0 through 2.17.1, update to a version that contains a fix for this issue to prevent arbitrary code injection. As a temporary workaround, consider restricting access to the Manage Filters page (manage filter page.php) to minimize the risk of exploitation. Avoid using crafted project names in the affected page until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-17782

GHSA-GGJM-7M5F-7XJV

Produtos afetados

Mantisbt

Referências · 7

• https://github.com/mantisbt/mantisbt · Nota
• https://github.com/mantisbt/mantisbt/commit/72ab020a42a35fd341e983a25849f8277bb34044 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17782 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ggjm-7m5f-7xjv · Aviso do Fabricante
• https://mantisbt.org/bugs/view.php?id=24813 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-17782 · Aviso do Fabricante
• https://mantisbt.org/blog/archives/mantisbt/613 · Aviso do Fabricante