Impact

Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs.

Patches Patch under development. The vulnerability will be fixed in MantisBT version 2.25.8.

Workarounds Disable wiki integration ( $gwikienable = OFF;)

References - https://mantisbt.org/bugs/view.php?id=32981

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.

An XSS issue was discovered in browsersearchplugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in managepluginpage.php and managepluginuninstall.php when a crafted plugin is installed.

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.

An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').

A cross-site scripting (XSS) vulnerability in the View Filters page (viewfilterspage.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATHINFO.

A cross-site scripting (XSS) vulnerability in the Manage Filters page (managefilterpage.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.

A cross-site scripting (XSS) vulnerability in the Edit Filter page (managefilteredit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csvexport.php generated CSV file in Excel.

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr[]= in a crafted bugactiongrouppage.php URL. (The target Issues can have Private view status, or belong to a private Project.)

In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them.

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private view status, or belonging to a private Project) via the bugarr[] parameter. This provides full access to potentially confidential information.

An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bugrevisionviewpage.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnoteid parameter.

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP.

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.

An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).

The projdoceditpage.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

The Timeline feature in myviewpage.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.

A cross-site scripting (XSS) vulnerability in the View Filters page (viewfilterspage.php) and Edit Filter page (managefiltereditpage.php) in MantisBT 2.1.0 through 2.17.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATHINFO. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.

An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.

MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in stringapi.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalinkpage.php?url= URI and (2) an open redirect via a loginpage.php?return= URI.

Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'viewtype' parameter.

Cross-site scripting (XSS) vulnerability in manageprojcatadd.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action.

Impact Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted bugarr[] parameter in bugactiongroupext.php.

Patches The vulnerability has been fixed in MantisBT version 2.25.6.

Workarounds None

Credits Thanks to d3vpoo1 for reporting the issue.

References - https://mantisbt.org/bugs/view.php?id=31086

If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip.

Impact Disclosure of the following information: - existence of the note - note author name - note creation timestamp - issue id the note belongs to

Patches See PR https://github.com/mantisbt/mantisbt/pull/2000

Workarounds None

References https://mantisbt.org/bugs/view.php?id=34434

Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when: - resolving or closing issues (bugchangestatuspage.php) belonging to a project linking said custom field - viewing issues (viewallbugpage.php) when the custom field is displayed as a column - printing issues (printallbugpage.php) when the custom field is displayed as a column

Impact Cross-site scripting (XSS).

Patches https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739be

Workarounds Ensure Custom Field Names do not contain HTML tags.

References - https://mantisbt.org/bugs/view.php?id=34432 - This is related to CVE-2020-25830 (same root cause, different affected pages)