GHSA-f633-865q-2mhh
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | >= 2.1.0, < 2.28.2 | 2.28.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.
### Impact
Cross-site scripting (XSS).
Note that By default, only users with *Manager* access level or above can save their filters publicly
### Patches
- 44f490bcf20fd491c1b8f3fc9dd041d8c2a30010
### Workarounds
- Prevent display of users' real name (set `$g_ show_user_realname = OFF;` in configuration)
- Restrict ability to store filters (set $`g_stored_query_create_threshold` / $`g_stored_query_create_shared_threshold` to `NOBODY`
### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
References
External links from the advisory. They lead to third-party sites.