GHSA-wfg2-2wmw-6894

ghsaUSosv

MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php

view advisory published 2022-05-05Licence: CC-BY-4.0

An XSS issue was discovered in browser_search_plugin.php in MantisBT up to and including 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-28508US	medium6.1	5.17% (92nd)	Exploit	2022-05-04
An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input f…

references

External citations — patches, advisories, analysis.

https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurabilityWEB
https://github.com/mantisbt/mantisbtPACKAGE
https://mantisbt.orgWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-28508ADVISORY
https://sourceforge.net/projects/mantisbtWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan