GHSA-74x7-mfvg-h2wf

MantisBT Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2010-2574

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	mantisbt/mantisbt	<= 1.2.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2010-2574 advisory
https://web.archive.org/web/20200515131055/http://www.securityfocus.com/archive/1/512886/100/0/threaded web
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048548.html web
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048639.html web
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048659.html web
http://www.mantisbt.org/bugs/changelog_page.php?version_id=111 web
http://www.mantisbt.org/bugs/view.php?id=12230 web
http://www.openwall.com/lists/oss-security/2010/09/14/12 web
http://www.openwall.com/lists/oss-security/2010/09/14/13 web