CVE-2020-25288: MantisBT XXS where a Custom Field with a crafted Regular Expression property is used
An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
Other sources
MantisBT XXS where a Custom Field with a crafted Regular Expression property is used
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.24.3
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-25288.
What is the severity level of CVE-2020-25288?
The severity level of CVE-2020-25288 is medium.
What is the affected software for CVE-2020-25288?
The affected software for CVE-2020-25288 is MantisBT before version 2.24.3.
How can this vulnerability be exploited?
This vulnerability can be exploited through HTML injection and potential execution of arbitrary code if CSP settings permit.
Is there a fix available for CVE-2020-25288?
Yes, the fix for CVE-2020-25288 can be found in MantisBT version 2.24.3.