CVE-2018-13055: MantisBT allows XSS via View Filters page
A cross-site scripting (XSS) vulnerability in the View Filters page (viewfilterspage.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATHINFO.
Other sources
MantisBT allows XSS via View Filters page
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.15.1
Event History
Frequently Asked Questions
What is CVE-2018-13055?
CVE-2018-13055 is a cross-site scripting (XSS) vulnerability in MantisBT versions 2.1.0 through 2.15.0.
How does CVE-2018-13055 affect MantisBT?
CVE-2018-13055 allows remote attackers to inject arbitrary code through a crafted PATH_INFO on the View Filters page in MantisBT.
How severe is CVE-2018-13055?
CVE-2018-13055 has a severity rating of 6.1 (medium).
How can I fix CVE-2018-13055?
To fix CVE-2018-13055, upgrade your MantisBT installation to version 2.15.1 or later.
Where can I find more information about CVE-2018-13055?
You can find more information about CVE-2018-13055 in the MantisBT blog post and the official MantisBT bug report.