CVE-2018-17782 - A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name

Back Back to CVE browser

MEDIUM

A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name

Published Oct 30, 2018

5.4

MEDIUM

CVSS 3.0

EPSS 0.69%

Description

A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://github.com/advisories/GHSA-ggjm-7m5f-7xjv
Advisory
https://github.com/mantisbt/mantisbt/commit/72ab020a42a35fd341e983a25849f8277bb34044
https://mantisbt.org/blog/archives/mantisbt/613
x_refsource_CONFIRMRelease NotesVendor Advisory
https://mantisbt.org/bugs/view.php?id=24813
x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-17782

Link	Providers	Tags
https://github.com/advisories/GHSA-ggjm-7m5f-7xjv		Advisory
https://github.com/mantisbt/mantisbt/commit/72ab020a42a35fd341e983a25849f8277bb34044
https://mantisbt.org/blog/archives/mantisbt/613		x_refsource_CONFIRMRelease NotesVendor Advisory
https://mantisbt.org/bugs/view.php?id=24813		x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-17782