CVE-2019-15074: MantisBT Cross-Site Scripting Vulnerability via Crafted Filename
Summary
CVE-2019-15074: MantisBT allows cross-site scripting (XSS) via crafted filename. Affects mantisbt/mantisbt versions < 2.21.2. Fixed in 2.21.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker designed for software development projects. It provides features such as bug tracking, project management, and collaboration tools. The software allows users to upload attachments to issues, which can enhance communication but also introduces security risks if not properly managed. This vulnerability specifically affects versions up to 2.21.1, where crafted filenames can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability exists in the Timeline feature of MantisBT, specifically in the my_view_page.php file. It allows an attacker to upload an attachment with a specially crafted filename that contains malicious scripts. When any user with visibility to the issue views the My View Page, the script executes, potentially leading to unauthorized actions or data theft. This stored XSS vulnerability can be exploited if Content Security Policy (CSP) settings do not adequately restrict script execution.
How To Fix
Minimum fixed version
2.21.2
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.21.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable file uploads or restrict the types of files that can be uploaded until the software is updated. Additionally, implementing a strict Content Security Policy (CSP) can help mitigate the risk of XSS attacks.
Conclusion
The CVE-2019-15074 vulnerability in MantisBT poses a significant risk through stored XSS via crafted filenames in attachments. It is crucial to update to version 2.21.2 or later to mitigate this risk. Users should also consider implementing additional security measures such as CSP to further protect their applications.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows execution of arbitrary scripts through crafted filenames in uploaded attachments.
Versions of MantisBT up to and including 2.21.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized actions, data theft, or other malicious activities performed in the context of the affected user.
Yes, you can temporarily disable file uploads or restrict the types of files that can be uploaded, and implement a strict Content Security Policy (CSP).
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
