GHSA-4rrc-5vp6-m3f6
MantisBT XSS issue on the view_all_bug_page.php
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | >= 2.1.0, < 2.24.2 | 2.24.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
References
External links from the advisory. They lead to third-party sites.