CVE-2023-49802 MantisBT LinkedCustomFields Cross-site Scripting vulnerability
An attacker can execute arbitrary JavaScript in MantisBT via crafted custom fields, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-49802?
CVE-2023-49802 is a medium-severity cross-site scripting vulnerability in mantisbt-plugins LinkedCustomFields, published on 11 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.
Weakness: CWE-79
Which versions are affected by CVE-2023-49802?
It affects 1 product.
Products include Mantisbt Linked Custom Fields.
How do I fix CVE-2023-49802?
No fix has been published for CVE-2023-49802 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-49802 being exploited?
There is no known exploitation of CVE-2023-49802 in the wild and no public exploit code.
Sources
Also known as GHSA-2f37-9xpx-5hhw.