CVE-2020-16266: MantisBT XSS issue on the view_all_bug_page.php
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
Other sources
MantisBT XSS issue on the viewallbugpage.php
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.24.2
Event History
Frequently Asked Questions
What is CVE-2020-16266?
CVE-2020-16266 is an XSS vulnerability discovered in MantisBT before version 2.24.2.
How does CVE-2020-16266 affect MantisBT?
CVE-2020-16266 allows a remote attacker to inject arbitrary HTML into the MantisBT view_all_bug_page.php by saving it into a text Custom Field.
What is the severity of CVE-2020-16266?
The severity of CVE-2020-16266 is medium, with a CVSS score of 5.4.
How can I fix CVE-2020-16266?
To fix CVE-2020-16266, update MantisBT to version 2.24.2 or later.
Are there any references for CVE-2020-16266?
Yes, you can find references for CVE-2020-16266 at the following links: 1. [MantisBT Blog Post](https://mantisbt.org/blog/archives/mantisbt/665) 2. [MantisBT Bug Entry](https://mantisbt.org/bugs/view.php?id=27056)