CVE-2018-17783

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Edit Filter page (manage_filter_edit_page.php) of MantisBT versions 2.1.0 through 2.17.1 [1][2]. The bug occurs because the project_get_name() function output is echoed directly into the HTML without sanitization; a crafted project name can inject arbitrary JavaScript. The vulnerability is exploitable only when the attacker has access rights to create or modify projects (e.g., a user with manager or administrator privileges) and when Content Security Policy (CSP) settings permit inline script execution [1].

Exploitation

An attacker with sufficient privileges to create or rename a project (typically a manager or administrator) can insert malicious JavaScript into the project name field. When an administrator or other user views the Edit Filter page for a filter that references that project, the unescaped project name is rendered in the span element, causing the injected script to execute in the victim's browser context [3][4]. The attack requires no additional user interaction beyond navigating to the affected page.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to theft of session cookies, modification of page content, or further actions within the MantisBT application under the victim's privileges. The impact is limited by the attacker's need for project management rights and permissive CSP settings, but an administrator viewing the filter edit page is fully compromised.

Mitigation

The fix was committed in commit b9453cd7643b7c5b1b8c716b1dbd4d7d9571d1ec and released in MantisBT version 2.17.1 [3][4]. Users should upgrade to 2.17.1 or later. If upgrading is not possible, a workaround is to restrict project creation and rename privileges to trusted users only, and to enforce a strict Content Security Policy that blocks inline scripts.