CVE-2017-12062: MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php
An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
Other sources
MantisBT vulnerable to XSS via unsanitized filter field in manageuserpage.php
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.5.2 - Upgrade
Upgrade
MantisBTto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12062?
CVE-2017-12062 has a medium severity due to its potential for XSS attacks.
How do I fix CVE-2017-12062?
To fix CVE-2017-12062, upgrade MantisBT to version 2.5.2 or later.
What systems are affected by CVE-2017-12062?
CVE-2017-12062 affects MantisBT versions from 2.1.0 up to but not including 2.5.2.
What type of vulnerability is CVE-2017-12062?
CVE-2017-12062 is an XSS (Cross-Site Scripting) vulnerability.
Can CVE-2017-12062 lead to data theft?
Yes, CVE-2017-12062 can lead to data theft by allowing attackers to execute arbitrary JavaScript.