CVE-2020-35571: MantisBT XSS Vulnerability in manage_custom_field_update.php
Summary
CVE-2020-35571: MantisBT XSS in manage_custom_field_update.php. Affects mantisbt/mantisbt versions < 2.25.0. Fixed in 2.25.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps teams manage and track issues effectively. It provides features such as issue tracking, project management, and collaboration tools. The software is widely used in various industries for its flexibility and ease of use. However, like many web applications, it can be susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
An XSS vulnerability exists in MantisBT versions up to 2.24.3, specifically in the manage_custom_field_update.php file. The issue arises from the helper_ensure_confirmed function, where the custom field name is not properly sanitized. This lack of sanitization can lead to the injection of malicious scripts, which may execute in the context of the user's browser, potentially allowing attackers to steal session cookies or perform actions on behalf of the user. The severity of this vulnerability is classified as moderate, with a CVSS score of 6.1.
How To Fix
Minimum fixed version
2.25.0
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement Content Security Policy (CSP) headers to mitigate the risk of XSS attacks. This can be done by adding the following HTTP header to your server configuration: 'Content-Security-Policy: default-src 'self';'. This will restrict the sources from which scripts can be executed, reducing the likelihood of successful XSS attacks.
Conclusion
The XSS vulnerability in MantisBT's manage_custom_field_update.php file poses a moderate risk to users of the software. It is crucial to update to the latest version to mitigate this risk. Implementing CSP headers can also provide an additional layer of security while a full update is being planned.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into the application.
MantisBT versions up to 2.24.3 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability could allow attackers to execute scripts in the user's browser, potentially leading to data theft or unauthorized actions.
Yes, the vulnerability has been patched in MantisBT version 2.25.0. It is recommended to update to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
