CVE-2017-12062 | BDVDB-2026-88339 Detail

Description#

An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://openwall.com/lists/oss-security/2017/08/01/1
http://www.securitytracker.com/id/1039030
https://mantisbt.org/bugs/view.php?id=23166
http://openwall.com/lists/oss-security/2017/08/01/2
https://github.com/mantisbt/mantisbt/commit/9b5b71dadbeeeec27efea59f562ac5bd6d2673b7

Exploit#

No public exploit known

History#

Version 12017-08-01Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.