[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Aug 2016 00:36:25 +0200
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: MantisBT: XSS in view_all_bug_page.php
Greetings,
Please assign a CVE ID for the following issue.
Description
-----------
An XSS vulnerability was discovered in MantisBT's Filter API, affecting
the View Issues page. It is caused by unescaped output of the
'view_type' GPC parameter, and can be exploited as follows:
http://example.com/mantis/view_all_bug_page.php?view_type="><script>alert('XSS');</script>
To resolve the issue, the parameter's value is sanitized prior to being
stored in the filter, ensuring only authorized values 'simple' and
'advanced' are saved, and subsequently printed on the hidden form field.
Affected versions
-----------------
- >= 1.2.0 (possibly older releases as well - not tested)
- >= 1.3.0-beta.1
- >= 2.0.0-beta.1
Fixed in versions:
------------------
- 1.3.1
- 2.0.0-beta.2
As of this writing, these have not been released yet, but both should be
available in the coming days. Until then, installations should be
patched manually.
Please note that MantisBT 1.2.20 was the last release in the legacy
1.2.x series, which is no longer supported; this vulnerability will
therefore NOT be patched in 1.2. All installations are strongly advised
to upgrade to MantisBT 1.3.
Patch
-----
See Github [1]
Credits
-------
The issue was discovered by Will Dollman of Netcraft Ltd, and fixed by
Damien Regad (MantisBT Developer).
References
----------
Further details available in our issue tracker [2]
Best regards,
D. Regad
MantisBT Developer
http://www.mantisbt.org
[1] https://github.com/mantisbt/mantisbt/commit/7086c2d8
[2] https://mantisbt.org/bugs/view.php?id=21611
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
