CVE-2017-12062: MantisBT XSS Vulnerability in Manage User Page
Summary
CVE-2017-12062: MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php. Affects mantisbt/mantisbt versions >= 2.0.0, < 2.5.2. Fixed in 2.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MantisBT is an open-source issue tracker that provides a user-friendly interface for managing software development projects. It allows users to report bugs, track issues, and collaborate on project management. The application is widely used due to its flexibility and ease of integration with various development environments. However, a vulnerability exists in versions 2.x before 2.5.2, where the 'filter' field in the Manage User page is not properly sanitized, exposing users to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the lack of sanitization of the 'filter' field in manage_user_page.php. This oversight allows attackers to inject arbitrary JavaScript code into the page, which can be executed in the context of the user's browser if Content Security Policy (CSP) is disabled. The ramifications include unauthorized actions being performed on behalf of the user, data theft, or session hijacking, making it a moderate security risk.
How To Fix
Minimum fixed version
2.5.2
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a Content Security Policy (CSP) on your web server to mitigate the risk of XSS attacks. This can be done by adding the following HTTP header to your server configuration: Content-Security-Policy: default-src 'self'; script-src 'self';
Conclusion
In summary, MantisBT has a vulnerability (CVE-2017-12062) that allows for XSS attacks due to unsanitized input in the Manage User page. It is crucial to update to version 2.5.2 or later to mitigate this risk. Implementing a CSP can also serve as a temporary workaround while ensuring the application remains secure.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
MantisBT versions 2.x before 2.5.2 are affected by this vulnerability.
If left unaddressed, attackers could exploit this vulnerability to execute malicious scripts in the context of users' browsers, leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a service that monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file, providing real-time insights into potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
