Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.

Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744

Workarounds Define $gpath as appropriate in configinc.php.

References https://mantisbt.org/bugs/view.php?id=19381

Credits

Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.

- Pier-Luc Maltais (https://twitter.com/plmaltais) - Hlib Yavorskyi (https://github.com/Kerkroups) - Jingshao Chen (https://github.com/shaozi) - Brandon Roldan - nhchoudhary

A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repodelete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.

viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php.

DISPUTED MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass.

A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (myviewpage.php) and User Information (viewuserpage.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATHINFO in a URL, due to use of unsanitized $SERVER['PHPSELF'] to generate URLs.

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php.

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (moveattachmentspage.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (configinc.php).

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by crafting any valid parameter.

A cross-site scripting (XSS) vulnerability in bugchangestatuspage.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'actiontype' parameter.

A cross-site scripting (XSS) vulnerability in viewfilterspage.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'viewtype' parameter.

SQL injection vulnerability in the manage configuration page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter.

Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mcprojectgetattachments function in api/soap/mcprojectapi.php; the (2) newsgetlimitedrows function in core/newsapi.php; the (3) summaryprintbyenum, (4) summaryprintbyage, (5) summaryprintbydeveloper, (6) summaryprintbyreporter, or (7) summaryprintbycategory function in core/summaryapi.php; the (8) createbugenumsummary or (9) enumbuggroup function in plugins/MantisGraph/core/graphapi.php; (10) buggraphbycategory.php or (11) buggraphbystatus.php in plugins/MantisGraph/pages/; or (12) projdocpage.php, related to use of the dbquery function, a different vulnerability than CVE-2014-1608.

SQL injection issues were discovered in MantisBT, an open source issue tracker.

CVE-2014-1608 patch: https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102

CVE-2014-1609 patch: https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f

It was reported that versions 1.1.0a4 to 1.2.15 are affected.

References: http://www.ocert.org/advisories/ocert-2014-001.html

Cross-site scripting (XSS) vulnerability in managecustomfieldeditpage.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Cross-site scripting (XSS) vulnerability in the filterdrawselectionarea2 function in core/filterapi.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the matchtype parameter to bugs/search.php.

Multiple cross-site scripting (XSS) vulnerabilities in core/summaryapi.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summaryprintbycategory function or (2) project name in the summaryprintbyproject function.

A denial of service flaw was found in the way MantisBT, a free popular web-based issue tracking system, performed processing of certain type of View Issues page search queries. A remote attacker could provide a specially-crafted query (filter combining some criteria and a text search with 'any condition') that, when processed by the MantisBT system, would lead to excessive system resources consumption (denial of service), possibly leading to complete MantisBT server instance unavailability.

References: [1] http://www.openwall.com/lists/oss-security/2013/03/21/3

Upstream bug report: [2] http://www.mantisbt.org/bugs/view.php?id=15573

Relevant upstream patch: [3] https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

Improper escaping of tag names retrieved from History in Timeline (myviewpage.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.

Impact Cross-site scripting (XSS).

Patches f32787c14d4518476fe7f05f992dbfe6eaccd815

Workarounds Edit offending History entries (using SQL) Wrap $this->tagname in a stringhtmlspecialchars() call in IssueTagTimelineEvent::html()

Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Improper escaping of Tag name when deleting it in tagdelete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.

Impact Cross-site scripting (XSS).

Patches 80990f43153167c73f11eb4b2bc7108d0c3d6b46

Workarounds Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 Manually edit language files to remove the sprintf placeholder %1$s from $stagdeletemessage string, for example with sed -r -i '/tagdeletemessage/s/.%1\$s.//' -- lang/

Credits MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.

Impact

Due to insufficient access-level checks, any non-admin user having access to manageconfigcolumnspage.php (typically project managers having MANAGER role) can use the Copy From action to retrieve the columns configuration from a private project they have no access to.

Access to the reverse operation (Copy To) is correctly controlled, i.e. it is not possible to alter the private project's configuration.

Patches The vulnerability will be fixed in MantisBT version 2.27.2.

Workarounds None

Credits Thanks to d3vpoo1 for reporting the issue.

Due to an incorrect use of loose (==) instead of strict (===) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.

[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authenticationapi.php#L782

Impact On MantisBT instances configured to use the MD5 login method, user accounts having a password hash evaluating to zero (i.e. matching regex ^0+[Ee][0-9]+$) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example comito5 (0e579603064547166083907005281618).

No password bruteforcing for individual users is needed, thus $gmaxfailedlogincount does not protect against the attack.

Patches Fixed in 2.27.2.

Workarounds Check the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL: sql SELECT username, email FROM mantisusertable WHERE password REGEXP '^0+[Ee][0-9]+$'

Credits Thanks to Harry Sintonen / Reversec for discovering and reporting the issue.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.

A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:

Impact - The entire activity stream becomes unviewable (UI fails to render). - New notes cannot be displayed, effectively breaking all future collaboration on the issue.

Patches Fixed in 2.27.2.

Workarounds None

Credits Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.

Impact

Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs.

Patches Patch under development. The vulnerability will be fixed in MantisBT version 2.25.8.

Workarounds Disable wiki integration ( $gwikienable = OFF;)

References - https://mantisbt.org/bugs/view.php?id=32981