CVE-2022-26144: MantisBT XSS Vulnerability Due to Improper Escaping
Summary
CVE-2022-26144: An XSS issue was discovered in MantisBT before 2.25.3. Affects mantisbt/mantisbt versions < 2.25.3. Fixed in 2.25.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that provides a flexible and easy-to-use platform for managing software development projects. It allows users to track bugs, manage tasks, and collaborate with team members. However, prior to version 2.25.3, MantisBT was vulnerable to an XSS (Cross-Site Scripting) attack due to improper escaping of plugin names, which could lead to the execution of arbitrary code.
Vulnerability Detail
An XSS issue was discovered in MantisBT before version 2.25.3. The vulnerability arises from improper escaping of a plugin name in the 'manage_plugin_page.php' and 'manage_plugin_uninstall.php' files. When a crafted plugin is installed, it allows an attacker to execute arbitrary code if the Content Security Policy (CSP) permits it. This could lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Minimum fixed version
2.25.3
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.25.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid installing untrusted plugins and ensure that your Content Security Policy (CSP) is configured to mitigate the risk of XSS attacks. Additionally, validate and sanitize plugin names before processing them.
Conclusion
The XSS vulnerability in MantisBT (CVE-2022-26144) poses a significant risk due to improper escaping of plugin names. It is crucial for users to update to version 2.25.3 or later to mitigate this risk. Additionally, employing best practices for plugin management and CSP configuration can further enhance security.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability could allow attackers to execute arbitrary code, leading to unauthorized actions, data theft, or other malicious activities.
Yes, you can avoid installing untrusted plugins and ensure that your Content Security Policy (CSP) is properly configured to reduce the risk of XSS attacks.
If you suspect that your application has been compromised, immediately update to the latest version of MantisBT and review your system for any unauthorized changes or data breaches.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
