CVE-2008-0404: XSS
Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Most active bugs" summary.
Other sources
Description of problem:
HTML tags are reportedly not escaped properly in "Most Active" section on "Summary" screen even if HTML tags are disabled via ghtmlvalidtags, which makes it possible to conduct a cross-site scripting attack.
Additional info:
Original report: http://bugs.mantisbt.org/view.php?id=8756
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0404?
CVE-2008-0404 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2008-0404?
To fix CVE-2008-0404, upgrade Mantis to version 1.1.1 or later, where the vulnerability has been addressed.
What is the impact of CVE-2008-0404?
The impact of CVE-2008-0404 allows attackers to inject arbitrary web scripts or HTML into the "Most active bugs" summary, compromising user security.
Which versions of Mantis are affected by CVE-2008-0404?
CVE-2008-0404 affects Mantis versions prior to 1.1.1, including multiple earlier versions.
What type of vulnerability is CVE-2008-0404?
CVE-2008-0404 is a cross-site scripting (XSS) vulnerability.