CVE-2020-35571: XSS
Published Feb 22, 2021
·Updated
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
Affected Software
2 affected componentsFixes available
MantisBT mantisbt<=2.24.3
composer/mantisbt/mantisbt<=2.24.5
2.25.0
Event History
Feb 22, 2021
CVE Published
via MITRE·02:23 AM
Data Sourced
via MITRE·02:23 AM
Description
May 24, 2022
Advisory Published
via GitHub·05:42 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-35571?
The severity of CVE-2020-35571 is medium.
2
How does CVE-2020-35571 affect MantisBT?
CVE-2020-35571 affects MantisBT version up to and including 2.24.3.
3
What is the vulnerability type of CVE-2020-35571?
The vulnerability type of CVE-2020-35571 is CWE-79 (Cross-site Scripting).
4
What is the reference link for CVE-2020-35571?
You can find the reference link for CVE-2020-35571 [here](https://mantisbt.org/bugs/view.php?id=27768).
5
How can I fix CVE-2020-35571?
To fix CVE-2020-35571, update MantisBT to version 2.24.4 or later.