CVE-2010-2802: XSS
A flaw was found in the way that the Mantis BTS handled attachments and MIME types. A user could upload an HTML file renamed to a .gif and Mantis would calculate the actual MIME type of the file as text/html. A user tricked into thinking they were clicking a .gif attachment would instead have the full HTML file rendered in the browser, rather than having it treated as a downloadable file or displayed in plain text.
References:
http://www.mantisbt.org/bugs/view.php?id=11952 http://www.mantisbt.org/blog/?p=113
This was corrected in upstream version 1.2.2 and affects current Fedora 12, 13, rawhide, and EPEL5.
Other sources
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.2 allows remote authenticated users to inject arbitrary web script or HTML via an HTML document with a .gif filename extension, related to inline attachments.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2802?
CVE-2010-2802 is classified as a medium-severity vulnerability due to its potential for exploitation through file upload tricks.
How do I fix CVE-2010-2802?
To mitigate CVE-2010-2802, upgrade to a patched version of MantisBT that addresses the issue with improperly handled attachments.
What is the impact of CVE-2010-2802?
CVE-2010-2802 allows an attacker to upload malicious HTML files disguised as image files, potentially leading to phishing or other attacks.
Which versions of MantisBT are affected by CVE-2010-2802?
CVE-2010-2802 affects multiple versions including MantisBT versions from 0.18.0 to 1.2.1.
Can CVE-2010-2802 lead to remote code execution?
CVE-2010-2802 does not directly lead to remote code execution, but it can facilitate phishing attacks or other malicious actions.