Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php.

Improper escaping of Tag name when deleting it in tagdelete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.

Impact Cross-site scripting (XSS).

Patches 80990f43153167c73f11eb4b2bc7108d0c3d6b46

Workarounds Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 Manually edit language files to remove the sprintf placeholder %1$s from $stagdeletemessage string, for example with sed -r -i '/tagdeletemessage/s/.%1\$s.//' -- lang/

Credits MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.

Improper escaping of tag names retrieved from History in Timeline (myviewpage.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.

Impact Cross-site scripting (XSS).

Patches f32787c14d4518476fe7f05f992dbfe6eaccd815

Workarounds Edit offending History entries (using SQL) Wrap $this->tagname in a stringhtmlspecialchars() call in IssueTagTimelineEvent::html()

Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.

Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744

Workarounds Define $gpath as appropriate in configinc.php.

References https://mantisbt.org/bugs/view.php?id=19381

Credits

Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.

- Pier-Luc Maltais (https://twitter.com/plmaltais) - Hlib Yavorskyi (https://github.com/Kerkroups) - Jingshao Chen (https://github.com/shaozi) - Brandon Roldan - nhchoudhary

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.

The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.

Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mcprojectgetattachments function in api/soap/mcprojectapi.php; the (2) newsgetlimitedrows function in core/newsapi.php; the (3) summaryprintbyenum, (4) summaryprintbyage, (5) summaryprintbydeveloper, (6) summaryprintbyreporter, or (7) summaryprintbycategory function in core/summaryapi.php; the (8) createbugenumsummary or (9) enumbuggroup function in plugins/MantisGraph/core/graphapi.php; (10) buggraphbycategory.php or (11) buggraphbystatus.php in plugins/MantisGraph/pages/; or (12) projdocpage.php, related to use of the dbquery function, a different vulnerability than CVE-2014-1608.

SQL injection issues were discovered in MantisBT, an open source issue tracker.

CVE-2014-1608 patch: https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102

CVE-2014-1609 patch: https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f

It was reported that versions 1.1.0a4 to 1.2.15 are affected.

References: http://www.ocert.org/advisories/ocert-2014-001.html

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

CAPTCHA bypass vulnerability in MantisBT before 1.2.19.

SQL injection vulnerability in the manage configuration page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter.

Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php.

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $fdatabase, $fdbusername, and $fadminusername variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (myviewpage.php) and User Information (viewuserpage.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATHINFO in a URL, due to use of unsanitized $SERVER['PHPSELF'] to generate URLs.

A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (configinc.php).

A cross-site scripting (XSS) vulnerability in bugchangestatuspage.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'actiontype' parameter.

A cross-site scripting (XSS) vulnerability in viewfilterspage.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'viewtype' parameter.

Cross-site scripting (XSS) vulnerability in managecustomfieldeditpage.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie.

Incomplete blacklist vulnerability in the configisprivate function in configapi.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.

viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php.

A denial of service flaw was found in the way MantisBT, a free popular web-based issue tracking system, performed processing of certain type of View Issues page search queries. A remote attacker could provide a specially-crafted query (filter combining some criteria and a text search with 'any condition') that, when processed by the MantisBT system, would lead to excessive system resources consumption (denial of service), possibly leading to complete MantisBT server instance unavailability.

References: [1] http://www.openwall.com/lists/oss-security/2013/03/21/3

Upstream bug report: [2] http://www.mantisbt.org/bugs/view.php?id=15573

Relevant upstream patch: [3] https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (moveattachmentspage.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.