CVE-2019-15539: MantisBT Stored XSS Vulnerability in Project Documentation Feature
Summary
CVE-2019-15539: MantisBT XSS when uploading an attachment. Affects mantisbt/mantisbt versions < 2.21.3. Fixed in 2.21.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker designed for managing software development projects. It provides features such as bug tracking, project management, and documentation management. The Project Documentation feature allows users to upload and manage documents related to their projects. However, prior to version 2.21.3, this feature was vulnerable to a stored cross-site scripting (XSS) attack, which could be exploited through crafted filenames of uploaded attachments.
Vulnerability Detail
The vulnerability arises from the proj_doc_edit_page.php file in MantisBT versions before 2.21.3. It allows an attacker to upload an attachment with a malicious filename that, when accessed, executes arbitrary code in the context of the user's browser. This can lead to unauthorized actions, data theft, or further exploitation of the user's session, especially if Content Security Policy (CSP) settings are permissive.
How To Fix
Minimum fixed version
2.21.3
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.21.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the document upload feature in MantisBT until you are able to update to a secure version. This can be done by modifying the configuration settings in your MantisBT installation.
Conclusion
The stored XSS vulnerability in MantisBT's Project Documentation feature poses a significant risk to users of versions prior to 2.21.3. It is crucial to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
It is a stored cross-site scripting (XSS) vulnerability that allows execution of arbitrary code through crafted filenames of uploaded attachments.
MantisBT versions prior to 2.21.3 are affected by this vulnerability.
An attacker could execute malicious scripts in the context of a user's session, leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
