CVE-2020-25830: XSS
An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bugactiongrouppage.php.
Other sources
An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bugactiongrouppage.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25830?
CVE-2020-25830 is a vulnerability in MantisBT before version 2.24.3 that allows an attacker to inject HTML and execute arbitrary JavaScript.
What is the severity of CVE-2020-25830?
CVE-2020-25830 has a severity rating of medium.
How does CVE-2020-25830 work?
CVE-2020-25830 works by improperly escaping a custom field's name, allowing an attacker to inject HTML and potentially execute arbitrary JavaScript code.
How can I fix CVE-2020-25830?
To fix CVE-2020-25830, you should upgrade to MantisBT version 2.24.3 or later.
Where can I find more information about CVE-2020-25830?
You can find more information about CVE-2020-25830 in the following references: [GitHub commit](http://github.com/mantisbt/mantisbt/commit/8c6f4d8859785b67fb80ac65100ac5259ed9237d) and [MantisBT bug report](https://mantisbt.org/bugs/view.php?id=27304).