PT-2018-14193 · Mantisbt · Mantisbt

Atrol + 1 · Published 2018-10-30 · Updated 2022-05-14 · CVE-2018-17782

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 2.1.0 through 2.17.1

Description A cross-site scripting issue in the Manage Filters page allows remote attackers to inject arbitrary code through a crafted project name, provided access rights and CSP settings permit it.

Recommendations For versions 2.1.0 through 2.17.1, update to a version that contains a fix for this issue to prevent arbitrary code injection. As a temporary workaround, consider restricting access to the Manage Filters page (manage filter page.php) to minimize the risk of exploitation. Avoid using crafted project names in the affected page until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-17782

GHSA-GGJM-7M5F-7XJV

Affected Products

Mantisbt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-17782 · Security Note
• https://osv.dev/vulnerability/GHSA-ggjm-7m5f-7xjv · Vendor Advisory
• https://mantisbt.org/bugs/view.php?id=24813 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17782 · Vendor Advisory
• https://mantisbt.org/blog/archives/mantisbt/613 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/72ab020a42a35fd341e983a25849f8277bb34044 · Note