medium6.1
CVE-2022-26144
MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php
Impact
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mantisbt/mantisbt | <= 2.25.2 | 2.25.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mantisbt | Mantisbt | before 2.25.3 |