MantisBT LinkedCustomFields Cross-site Scripting vulnerability
Published Dec 11, 2023
6.7
MEDIUMCVSS 3.1
EPSS 0.66%
Description
The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.
Affected products
-
Affected
- < 2.0.1
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Mantisbt-Plugins | LinkedCustomFields | unknown | Affected
|
- < 2.0.1
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-53714 Advisory
- https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286 x_refsource_MISCPatch
- https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10 x_refsource_MISCIssue TrackingPatch
- https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11 x_refsource_MISCIssue Tracking
- https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhw x_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-53714 | Advisory | |
| https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286 | x_refsource_MISCPatch | |
| https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10 | x_refsource_MISCIssue TrackingPatch | |
| https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11 | x_refsource_MISCIssue Tracking | |
| https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhw | x_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data