CVE-2021-33557: MantisBT allows XSS in manage_custom_field_edit_page.php
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
Other sources
MantisBT allows XSS in managecustomfieldeditpage.php
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.25.2
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-33557.
What is the severity of CVE-2021-33557?
The severity of CVE-2021-33557 is medium.
What is the affected software for CVE-2021-33557?
The affected software for CVE-2021-33557 is MantisBT before 2.25.2.
What is the description of CVE-2021-33557?
CVE-2021-33557 is an XSS issue in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
How can I fix the vulnerability CVE-2021-33557?
To fix CVE-2021-33557, you should update MantisBT to version 2.25.2 or later.