CVE-2023-49802: MantisBT LinkedCustomFields Cross-site Scripting vulnerability
First published: Mon Dec 11 2023(Updated: )
The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mantisbt Linked Custom Fields | <2.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhw
- https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10
- https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11
- https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286
Frequently Asked Questions
What is the severity of CVE-2023-49802?
The severity of CVE-2023-49802 is medium with a CVSS score of 6.7.
How can I fix the MantisBT LinkedCustomFields Cross-site Scripting vulnerability?
To fix the MantisBT LinkedCustomFields Cross-site Scripting vulnerability, upgrade to version 2.0.1 or higher of the LinkedCustomFields plugin.
What is the CWE associated with CVE-2023-49802?
The CWE associated with CVE-2023-49802 is CWE-79.
- collector/nvd-api
- agent/references
- agent/type
- agent/event
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/title
- agent/tags
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- vendor/mantisbt
- canonical/mantisbt linked custom fields