Описание
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| mantis | removed | package |
EPSS
Процентиль: 66%
0.01178
Низкий
Связанные уязвимости
CVSS3: 5.4
nvd
около 6 лет назад
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
CVSS3: 5.4
github
больше 4 лет назад
MantisBT XSS issue on the view_all_bug_page.php
EPSS
Процентиль: 66%
0.01178
Низкий