CVE-2018-13055: MantisBT Cross-Site Scripting Vulnerability in View Filters Page
Summary
CVE-2018-13055: MantisBT allows XSS via View Filters page. Affects mantisbt/mantisbt versions >= 2.1.0, < 2.15.1. Fixed in 2.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps teams manage and track issues effectively. It offers features such as project management, issue tracking, and reporting. However, versions 2.1.0 through 2.15.0 are vulnerable to a cross-site scripting (XSS) attack, which can allow attackers to inject malicious scripts into the application, potentially compromising user data and security.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the View Filters page (view_filters_page.php) of MantisBT. Attackers can exploit this flaw by crafting a malicious URL that includes arbitrary code in the PATH_INFO. If the Content Security Policy (CSP) settings of the application permit it, this code can be executed in the context of the user's browser, leading to unauthorized actions or data theft.
How To Fix
Minimum fixed version
2.15.1
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a strict Content Security Policy (CSP) to mitigate the risk of XSS attacks. This can be done by adding the following HTTP header to your server configuration: Content-Security-Policy: default-src 'self'; script-src 'self';
Conclusion
The CVE-2018-13055 vulnerability in MantisBT poses a significant risk due to its potential for cross-site scripting attacks. It is crucial for users of affected versions to update to version 2.15.1 or later to safeguard their applications. Implementing a strict CSP can serve as a temporary measure to reduce risk.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
MantisBT versions 2.1.0 through 2.15.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of a user's session, potentially leading to data theft or unauthorized actions.
Yes, implementing a strict Content Security Policy (CSP) can help mitigate the risk of XSS attacks until you can update to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
