PT-2019-9315

CVE-2018-16514

Published

2019-06-20

Updated

2022-05-24

Description by

CVSS 3.1

4.7

Medium

MetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 2.1.0 through 2.17.0

Description A cross-site scripting (XSS) issue exists in the View Filters page and Edit Filter page, allowing remote attackers to inject arbitrary code through a crafted PATH INFO, provided that the Content Security Policy (CSP) settings permit it.

Recommendations For MantisBT versions 2.1.0 through 2.17.0, update to a version that includes a complete fix for the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Brian Carpenter

Geeknik

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2018-16514