CVE-2020-16266: XSS
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-16266?
CVE-2020-16266 is an XSS vulnerability discovered in MantisBT before version 2.24.2.
How does CVE-2020-16266 affect MantisBT?
CVE-2020-16266 allows a remote attacker to inject arbitrary HTML into the MantisBT view_all_bug_page.php by saving it into a text Custom Field.
What is the severity of CVE-2020-16266?
The severity of CVE-2020-16266 is medium, with a CVSS score of 5.4.
How can I fix CVE-2020-16266?
To fix CVE-2020-16266, update MantisBT to version 2.24.2 or later.
Are there any references for CVE-2020-16266?
Yes, you can find references for CVE-2020-16266 at the following links: 1. [MantisBT Blog Post](https://mantisbt.org/blog/archives/mantisbt/665) 2. [MantisBT Bug Entry](https://mantisbt.org/bugs/view.php?id=27056)