CVE-2019-15539: MantisBT XSS when uploading an attachment
MantisBT XSS when uploading an attachment
Other sources
The projdoceditpage.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.21.3
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-15539.
What is the severity rating of CVE-2019-15539?
CVE-2019-15539 has a severity rating of medium (6.1).
What is the affected software for CVE-2019-15539?
The affected software for CVE-2019-15539 is MantisBT version up to exclusive 2.21.3.
What is the CWE classification for CVE-2019-15539?
CVE-2019-15539 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
How can I fix the CVE-2019-15539 vulnerability?
To fix the CVE-2019-15539 vulnerability, you should update MantisBT to version 2.21.3 or later.