GitHub Advisoryadvisory · Packagist

GHSA-w93w-rx52-24qh MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php

MEDIUM Published 2022-05-17 Modified 2025-06-09 Official page ↗
Aliases
CVE-2017-12062
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-06-09

Affected packages

• Packagist mantisbt/mantisbt: >= 2.0.0, < 2.5.2 → fixed in 2.5.2

Description

An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

Related

Alias · CVE (1)

  • CVE-2017-12062 An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References