HIGH

GHSA-f633-865q-2mhh

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

Quick fix

GHSA-f633-865q-2mhh — mantisbt/mantisbt: upgrade to the fixed version with the command below.

composer require mantisbt/mantisbt:^2.28.2

Details

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.

### Impact Cross-site scripting (XSS).

Note that By default, only users with *Manager* access level or above can save their filters publicly

### Patches - 44f490bcf20fd491c1b8f3fc9dd041d8c2a30010

### Workarounds - Prevent display of users' real name (set `$g_ show_user_realname = OFF;` in configuration) - Restrict ability to store filters (set $`g_stored_query_create_threshold` / $`g_stored_query_create_shared_threshold` to `NOBODY`

### Credits Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mantisbt/mantisbt

Introduced in: 2.1.0Fixed in: 2.28.2

Fixcomposer require mantisbt/mantisbt:^2.28.2

Details

Are you affected?

Affected packages

References