GitHub Advisoryadvisory · Packagist

GHSA-74gh-5j33-vg4w MantisBT allows XSS on the Edit Filter page via crafted filter name

MEDIUM Published 2022-05-14 Modified 2025-05-30 Official page ↗
Aliases
CVE-2018-14504
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-05-30

Affected packages

• Packagist mantisbt/mantisbt: >= 2.0.0, < 2.15.1 → fixed in 2.15.1

Description

An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').

Related

Alias · CVE (1)

  • CVE-2018-14504 An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References