CVE-2018-16514: MantisBT Cross-Site Scripting Vulnerability via Crafted PATH_INFO
Summary
CVE-2018-16514: MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO. Affects mantisbt/mantisbt versions >= 2.1.0, < 2.17.1. Fixed in 2.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that helps teams manage and track software development projects. It provides features such as bug tracking, project management, and collaboration tools. However, versions 2.1.0 through 2.17.0 are vulnerable to a cross-site scripting (XSS) attack, which can allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability exists in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) of MantisBT versions 2.1.0 to 2.17.0. This vulnerability allows remote attackers to inject arbitrary code into the application if Content Security Policy (CSP) settings permit it. The issue arises from an incomplete fix for a previous vulnerability (CVE-2018-13055), making it critical for users to address this flaw to prevent potential exploitation.
How To Fix
Minimum fixed version
2.17.1
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.17.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement stricter Content Security Policy (CSP) settings to mitigate the risk of XSS attacks. This can be done by adding the following HTTP header to your web server configuration: Content-Security-Policy: default-src 'self'; script-src 'self';. However, this is not a permanent solution and updating the software is strongly recommended.
Conclusion
The cross-site scripting vulnerability in MantisBT poses a significant risk to users of versions 2.1.0 through 2.17.0. It is crucial to update to the latest version to protect against potential attacks. Implementing temporary workarounds can help mitigate risks, but they should not replace a proper update.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
MantisBT versions 2.1.0 through 2.17.0 are affected by this vulnerability.
If exploited, attackers can inject malicious scripts that may compromise user data, session tokens, or perform actions on behalf of users.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, the permanent fix is to update MantisBT to version 2.17.1 or later, which addresses the XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
