Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Aug 2016 00:36:25 +0200
From: Damien Regad <>
Subject: MantisBT: XSS in view_all_bug_page.php


Please assign a CVE ID for the following issue.

An XSS vulnerability was discovered in MantisBT's Filter API, affecting 
the View Issues page. It is caused by unescaped output of the 
'view_type' GPC parameter, and can be exploited as follows:"><script>alert('XSS');</script>

To resolve the issue, the parameter's value is sanitized prior to being 
stored in the filter, ensuring only authorized values 'simple' and 
'advanced' are saved, and subsequently printed on the hidden form field.

Affected versions
- >= 1.2.0 (possibly older releases as well - not tested)
- >= 1.3.0-beta.1
- >= 2.0.0-beta.1

Fixed in versions:
- 1.3.1
- 2.0.0-beta.2

As of this writing, these have not been released yet, but both should be 
available in the coming days. Until then, installations should be 
patched manually.

Please note that MantisBT 1.2.20 was the last release in the legacy 
1.2.x series, which is no longer supported; this vulnerability will 
therefore NOT be patched in 1.2. All installations are strongly advised 
to upgrade to MantisBT 1.3.

See Github [1]

The issue was discovered by Will Dollman of Netcraft Ltd, and fixed by 
Damien Regad (MantisBT Developer).

Further details available in our issue tracker [2]

Best regards,
D. Regad
MantisBT Developer


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.