MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name
    allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript
    when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom
    field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or
    printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2
    contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
    (CVE-2024-34081)

According to its version number, the MantisBT application hosted on the remote web server is prior to 2.26.2. It is, therefore, affected by the following vulnerabilities :

  - Insufficient access control in the registration and password reset process allows an attacker to reset another     user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only     possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has     been opened, and the user did not complete the process by updating their password. (CVE-2024-34077)

  - If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets     hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available     via the link, link label, and tooltip. (CVE-2024-34080)

  - Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve     execution of arbitrary JavaScript when resolving or closing issues belonging to a project linking said custom field,     or viewing or printing issues when the custom field is displayed as a column. (CVE-2024-34081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
419927	SCA: security update for mantisbt/mantisbt (GHSA-wgx7-jp56-65mq)	Tenable Cloud Security	SCA Checks	medium
419927	SCA: security update for mantisbt/mantisbt (GHSA-wgx7-jp56-65mq)	Tenable Self-Hosted Container Security	SCA Checks	medium
197939	MantisBT < 2.26.2 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-34081

medium

Tenable Plugins

medium

medium

high