CVE-2010-2574: MantisBT Cross-site Scripting Vulnerability in manage_proj_cat_add.php
Summary
CVE-2010-2574: MantisBT Cross-site Scripting vulnerability. Affects mantisbt/mantisbt versions < 1.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MantisBT is an open-source issue tracker designed for software development projects. It provides features such as project management, bug tracking, and collaboration tools. However, the application has been found to have a Cross-site Scripting (XSS) vulnerability in the manage_proj_cat_add.php file, which can be exploited by authenticated administrators to inject malicious scripts.
Vulnerability Detail
The vulnerability arises from improper validation of user input in the 'name' parameter during the Add Category action in manage_proj_cat_add.php. This allows remote authenticated administrators to inject arbitrary web scripts or HTML, potentially leading to unauthorized actions, data theft, or session hijacking. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the manage_proj_cat_add.php file to only trusted administrators or implement input validation on the 'name' parameter to sanitize user input.
Conclusion
The CVE-2010-2574 vulnerability in MantisBT poses significant risks due to its potential for XSS attacks. It is crucial for users to update their installations to the latest patched versions and implement recommended workarounds to mitigate risks.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Authenticated administrators of MantisBT 1.2.2 are primarily affected, as they can exploit the vulnerability to inject scripts.
Exploitation can lead to unauthorized actions, data theft, session hijacking, and damage to the integrity of the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
