Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.
Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744
Workarounds Define $gpath as appropriate in configinc.php.
References https://mantisbt.org/bugs/view.php?id=19381
Credits
Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.
- Pier-Luc Maltais (https://twitter.com/plmaltais) - Hlib Yavorskyi (https://github.com/Kerkroups) - Jingshao Chen (https://github.com/shaozi) - Brandon Roldan - nhchoudhary
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php.
DISPUTED MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass.
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (myviewpage.php) and User Information (viewuserpage.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATHINFO in a URL, due to use of unsanitized $SERVER['PHPSELF'] to generate URLs.
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php.
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (moveattachmentspage.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (configinc.php).
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
A cross-site scripting (XSS) vulnerability in bugchangestatuspage.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'actiontype' parameter.
A cross-site scripting (XSS) vulnerability in viewfilterspage.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'viewtype' parameter.
SQL injection vulnerability in the manage configuration page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter.
Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mcprojectgetattachments function in api/soap/mcprojectapi.php; the (2) newsgetlimitedrows function in core/newsapi.php; the (3) summaryprintbyenum, (4) summaryprintbyage, (5) summaryprintbydeveloper, (6) summaryprintbyreporter, or (7) summaryprintbycategory function in core/summaryapi.php; the (8) createbugenumsummary or (9) enumbuggroup function in plugins/MantisGraph/core/graphapi.php; (10) buggraphbycategory.php or (11) buggraphbystatus.php in plugins/MantisGraph/pages/; or (12) projdocpage.php, related to use of the dbquery function, a different vulnerability than CVE-2014-1608.
SQL injection issues were discovered in MantisBT, an open source issue tracker.
CVE-2014-1608 patch: https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102
CVE-2014-1609 patch: https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f
It was reported that versions 1.1.0a4 to 1.2.15 are affected.
References: http://www.ocert.org/advisories/ocert-2014-001.html
Cross-site scripting (XSS) vulnerability in managecustomfieldeditpage.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Cross-site scripting (XSS) vulnerability in the filterdrawselectionarea2 function in core/filterapi.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the matchtype parameter to bugs/search.php.
Multiple cross-site scripting (XSS) vulnerabilities in core/summaryapi.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summaryprintbycategory function or (2) project name in the summaryprintbyproject function.
A denial of service flaw was found in the way MantisBT, a free popular web-based issue tracking system, performed processing of certain type of View Issues page search queries. A remote attacker could provide a specially-crafted query (filter combining some criteria and a text search with 'any condition') that, when processed by the MantisBT system, would lead to excessive system resources consumption (denial of service), possibly leading to complete MantisBT server instance unavailability.
References: [1] http://www.openwall.com/lists/oss-security/2013/03/21/3
Upstream bug report: [2] http://www.mantisbt.org/bugs/view.php?id=15573
Relevant upstream patch: [3] https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.
Improper escaping of tag names retrieved from History in Timeline (myviewpage.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.
Impact Cross-site scripting (XSS).
Patches f32787c14d4518476fe7f05f992dbfe6eaccd815
Workarounds Edit offending History entries (using SQL) Wrap $this->tagname in a stringhtmlspecialchars() call in IssueTagTimelineEvent::html()
Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.
Improper escaping of Tag name when deleting it in tagdelete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.
Impact Cross-site scripting (XSS).
Patches 80990f43153167c73f11eb4b2bc7108d0c3d6b46
Workarounds Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 Manually edit language files to remove the sprintf placeholder %1$s from $stagdeletemessage string, for example with sed -r -i '/tagdeletemessage/s/.%1\$s.//' -- lang/
Credits MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.
An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $fdatabase, $fdbusername, and $fadminusername variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.
Cross-site scripting (XSS) vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303.
A flaw was found in the way that the Mantis BTS handled attachments and MIME types. A user could upload an HTML file renamed to a .gif and Mantis would calculate the actual MIME type of the file as text/html. A user tricked into thinking they were clicking a .gif attachment would instead have the full HTML file rendered in the browser, rather than having it treated as a downloadable file or displayed in plain text.
References:
http://www.mantisbt.org/bugs/view.php?id=11952 http://www.mantisbt.org/blog/?p=113
This was corrected in upstream version 1.2.2 and affects current Fedora 12, 13, rawhide, and EPEL5.
MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.