Описание
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
Ссылки
- Release NotesVendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
- Release NotesVendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.24.2 (исключая)
cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
EPSS
Процентиль: 50%
0.00274
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.4
debian
больше 5 лет назад
An XSS issue was discovered in MantisBT before 2.24.2. Improper escapi ...
CVSS3: 5.4
github
больше 3 лет назад
MantisBT XSS issue on the view_all_bug_page.php
EPSS
Процентиль: 50%
0.00274
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79