high7.8
CVE-2021-43257
MantisBT CSV Injection unprivileged user access in csv_export.php
Impact
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mantisbt/mantisbt | <= 2.25.2 | 2.25.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mantisbt | Mantisbt | before 2.25.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mantisbt/mantisbt/commit/7f4534c723e3162b8784aebda4836324041dbc3e
- https://www.mantisbt.org/bugs/view.php?id=29130
- https://github.com/advisories/GHSA-rg8f-5p7x-m6wv
- https://nvd.nist.gov/vuln/detail/CVE-2021-43257
- https://github.com/mantisbt/mantisbt/commit/99eb8d41cbacc703f88807898dcc9ac55eec0f15