Date: Thu, 18 Aug 2016 00:36:25 +0200 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: MantisBT: XSS in view_all_bug_page.php Greetings, Please assign a CVE ID for the following issue. Description ----------- An XSS vulnerability was discovered in MantisBT's Filter API, affecting the View Issues page. It is caused by unescaped output of the 'view_type' GPC parameter, and can be exploited as follows: http://example.com/mantis/view_all_bug_page.php?view_type="><script>alert('XSS');</script> To resolve the issue, the parameter's value is sanitized prior to being stored in the filter, ensuring only authorized values 'simple' and 'advanced' are saved, and subsequently printed on the hidden form field. Affected versions ----------------- - >= 1.2.0 (possibly older releases as well - not tested) - >= 1.3.0-beta.1 - >= 2.0.0-beta.1 Fixed in versions: ------------------ - 1.3.1 - 2.0.0-beta.2 As of this writing, these have not been released yet, but both should be available in the coming days. Until then, installations should be patched manually. Please note that MantisBT 1.2.20 was the last release in the legacy 1.2.x series, which is no longer supported; this vulnerability will therefore NOT be patched in 1.2. All installations are strongly advised to upgrade to MantisBT 1.3. Patch ----- See Github  Credits ------- The issue was discovered by Will Dollman of Netcraft Ltd, and fixed by Damien Regad (MantisBT Developer). References ---------- Further details available in our issue tracker  Best regards, D. Regad MantisBT Developer http://www.mantisbt.org  https://github.com/mantisbt/mantisbt/commit/7086c2d8  https://mantisbt.org/bugs/view.php?id=21611
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.