CVE-2020-25288: MantisBT Custom Field XXS Vulnerability Leading to HTML Injection
Summary
CVE-2020-25288: MantisBT XXS where a Custom Field with a crafted Regular Expression property is used. Affects mantisbt/mantisbt versions >= 2.23.0, < 2.24.3. Fixed in 2.24.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker designed for managing software development projects. It provides features such as bug tracking, project management, and customizable workflows. However, prior to version 2.24.3, MantisBT was vulnerable to a cross-site scripting (XXS) attack when a Custom Field with a crafted Regular Expression property was used, allowing attackers to inject malicious HTML and JavaScript into the application.
Vulnerability Detail
The vulnerability arises from improper escaping of the pattern attribute in form inputs when editing an issue in a project that utilizes a Custom Field with a crafted Regular Expression. This flaw can lead to HTML injection, which, depending on the Content Security Policy (CSP) settings, may allow for the execution of arbitrary JavaScript. The potential ramifications include unauthorized access to user data, session hijacking, and other malicious activities.
How To Fix
Minimum fixed version
2.24.3
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.24.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of Custom Fields with Regular Expression properties until the application can be updated to the patched version. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
In summary, CVE-2020-25288 is a significant vulnerability in MantisBT that can lead to serious security risks if not addressed. Users are strongly advised to update to version 2.24.3 or later to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
CVE-2020-25288 is a vulnerability in MantisBT that allows for cross-site scripting (XXS) attacks through improperly handled Custom Fields with crafted Regular Expressions.
If you are using MantisBT version 2.23.0 or earlier, your installation is vulnerable. Check your version by navigating to the 'About' section in the application.
Exploitation of this vulnerability can lead to HTML injection, allowing attackers to execute arbitrary JavaScript, potentially compromising user data and application integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
