GHSA-98xr-mmq5-vc5h

    Dashboard / Vulnerabilities / GHSA-98xr-mmq5-vc5h

    GHSA-98xr-mmq5-vc5h

    Published: 13 May 2022Last Modified: 30 May 2025

    Summary: MantisBT XSS allows unsanitized input via admin/install.php

    Details: An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-12061, https://github.com/mantisbt/mantisbt/commit/17f9b94f031ba93ae2a727bca0e68458ecd08fb0, https://github.com/mantisbt/mantisbt/commit/c73ae3d3d4dd4681489a9e697e8ade785e27cba5, https://github.com/mantisbt/mantisbt, https://mantisbt.org/bugs/view.php?id=23146, https://web.archive.org/web/20170811053146/http://www.securitytracker.com/id/1039030, http://openwall.com/lists/oss-security/2017/08/01/1, http://openwall.com/lists/oss-security/2017/08/01/2

    Affected packages

    Package

    Name: mantisbt/mantisbt

    Purl: pkg:composer/mantisbt/mantisbt

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.3.12

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High