CVE-2018-14504

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in manage_filter_edit_page.php in MantisBT versions 2.x through 2.15.0 [1]. The application fails to properly sanitize the filter name before echoing it into an `` field's value attribute, allowing an attacker to inject arbitrary HTML and JavaScript. No special configuration is required beyond a standard MantisBT installation; the vulnerability is reachable when a user views or edits a filter with a crafted name [3].

Exploitation

An authenticated user with the ability to create or edit filters sets a filter name containing a malicious payload, such as foobar" onclick="alert(1) [1]. When another user (including an administrator) visits the Edit Filter page (e.g., manage_filter_edit_page.php), the unsanitized payload is rendered in the page's HTML. The attacker does not require a privileged account beyond filter creation permissions, and the exploit triggers upon page load (if CSP settings allow inline event handlers) [1] [3].

Impact

Successful exploitation results in arbitrary JavaScript execution in the context of the victim's browser, which can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The impact is limited by Content Security Policy (CSP) settings; if CSP denies inline scripts, the attack is only possible if event handlers are not restricted [1]. The attacker gains no direct access to the server, but can compromise the victim's session and data within the MantisBT application [2].

Mitigation

The vulnerability is fixed in MantisBT version 2.16.0 and 2.15.1, released on or about August 3, 2018 [4]. The patch applies string_display_line() to escape the filter name output [3]. Users should upgrade to the latest supported version. If upgrading is not immediately possible, system administrators can implement a strict Content Security Policy that disallows inline event handlers as a temporary workaround [1].