CVE-2022-28508: MantisBT XSS Vulnerability in browser_search_plugin.php
Summary
CVE-2022-28508: MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php. Affects mantisbt/mantisbt versions < 2.25.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that helps teams manage software development projects efficiently. It provides features such as bug tracking, project management, and collaboration tools. However, versions up to and including 2.25.2 are vulnerable to a cross-site scripting (XSS) attack due to unescaped output in the browser_search_plugin.php file, which can lead to security breaches.
Vulnerability Detail
The vulnerability arises from the unescaped output of the 'return' parameter in browser_search_plugin.php, allowing attackers to inject malicious code into a hidden input field. This can lead to unauthorized actions being performed on behalf of the user, compromising the integrity of the application and potentially exposing sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize the input from the 'return' parameter before processing it. This can be done by adding a validation step to escape any potentially harmful characters. Example code snippet: 'return
htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
'.
Conclusion
The XSS vulnerability in MantisBT's browser_search_plugin.php poses a significant risk to users of versions up to 2.25.2. It is crucial to update to the latest version to protect against potential attacks. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of the user's session, leading to data theft or unauthorized actions.
Yes, a patch is available in MantisBT version 2.25.3 and later. It is recommended to update to this version or higher.
If you cannot update immediately, implement input sanitization as a temporary workaround to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
