GHSA-6jh4-47v2-4g37
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | < 2.28.2 | 2.28.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject HTML.
While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.
### Impact
Cross-site scripting (XSS).
### Patches
- b1ebc57763f104eb5f541b7b4d1ce6948168abd9
### Workarounds
None
### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
References
External links from the advisory. They lead to third-party sites.