CVE-2015-2046: XSS
Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
Other sources
It was reported [1] that the MantisBT Configuration Report (admconfigreport.php) did not properly sanitize the form variables used when saving a filter, allowing an attacker to embed JavaScript code which would be executed in the client's browser when displaying the page.
Affected versions: - >= 1.2.13 - 1.3.0-beta.1
Fixed in versions: - 1.2.20 (not yet released) - 1.3.0-beta.2 (not yet released)
Patch: See Github [1]
Further details will be available in MantisBT issue tracker [2] once this goes public.
[1] https://github.com/mantisbt/mantisbt/commit/6defeed5 (1.2.x) https://github.com/mantisbt/mantisbt/commit/3c6f6e56 (1.3.x) [2] https://www.mantisbt.org/bugs/view.php?id=19301
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2046?
CVE-2015-2046 has been classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2015-2046?
To fix CVE-2015-2046, upgrade to MantisBT version 1.2.20 or later.
Which versions of MantisBT are affected by CVE-2015-2046?
MantisBT versions 1.2.13 through 1.2.19 are affected by CVE-2015-2046.
What type of vulnerability is CVE-2015-2046?
CVE-2015-2046 is a cross-site scripting (XSS) vulnerability.
Is there a workaround for CVE-2015-2046?
There is no official workaround for CVE-2015-2046; upgrading to a patched version is recommended.