CVE-2024-34081: MantisBT Cross-site Scripting vulnerability
Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when: - resolving or closing issues (bugchangestatuspage.php) belonging to a project linking said custom field - viewing issues (viewallbugpage.php) when the custom field is displayed as a column - printing issues (printallbugpage.php) when the custom field is displayed as a column
Impact Cross-site scripting (XSS).
Patches https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739be
Workarounds Ensure Custom Field Names do not contain HTML tags.
References - https://mantisbt.org/bugs/view.php?id=34432 - This is related to CVE-2020-25830 (same root cause, different affected pages)
Other sources
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (bugchangestatuspage.php) belonging to a project linking said custom field, viewing issues (viewallbugpage.php) when the custom field is displayed as a column, or printing issues (printallbugpage.php) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34081?
CVE-2024-34081 has been classified with a high severity due to its potential for arbitrary JavaScript execution.
How do I fix CVE-2024-34081?
To mitigate CVE-2024-34081, upgrade to MantisBT version 2.26.2 or later.
What types of attacks are possible with CVE-2024-34081?
CVE-2024-34081 allows attackers to inject HTML and potentially execute arbitrary JavaScript if CSP settings are permissive.
Which versions of MantisBT are affected by CVE-2024-34081?
CVE-2024-34081 affects all versions of MantisBT prior to 2.26.2.
Where does CVE-2024-34081 occur in MantisBT?
CVE-2024-34081 can be exploited while resolving or closing issues and viewing issues that link to a vulnerable custom field.