MantisBT XXS where a Custom Field with a crafted Regular Expression property is used
An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-25288US | medium4.8 | — | ||
An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of… | ||||
02
references
External citations — patches, advisories, analysis.
- http://github.com/mantisbt/mantisbt/commit/221cf323f16a9738a5b27aaba94758f11281d85cWEB
- https://github.com/mantisbt/mantisbtPACKAGE
- https://github.com/mantisbt/mantisbt/commit/221cf323f16a9738a5b27aaba94758f11281d85cWEB
- https://mantisbt.org/bugs/view.php?id=27275WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-25288ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan