Skip to content
Log inStart free trial

GHSA-mcqj-7p29-9528 CVE-2024-23830

MantisBT Host Header Injection vulnerability

High Packagist
Severity
8.3 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.96%
Chance of exploitation in the next 30 days. Higher than 61.63% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Fix
2.26.1
Upgrade mantisbt/mantisbt to this version or later

Description

Impact

Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.

Patches

https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744

Workarounds

Define $g_path as appropriate in config_inc.php.

References

https://mantisbt.org/bugs/view.php?id=19381

Credits

Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.

Affected versions

Packagist

PackageVulnerableFixed in
mantisbt/mantisbt
< 2.26.1
2.26.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

mantisbt/mantisbt Packagist → 2.26.1

composer
composer require mantisbt/mantisbt:^2.26.1

Severity breakdown

CVSS 3.1 8.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Weakness

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How to prevent it
  • Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-h2wf-967x-gxvw
MantisBT: Stored XSS in print_all_bug_page_word.php
High Also affects mantisbt/mantisbt
GHSA-4vpf-w7qv-5h3q
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Medium Also affects mantisbt/mantisbt
GHSA-3v2j-6fw9-f57c
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Medium Also affects mantisbt/mantisbt
GHSA-vcrw-4xvv-jh49
MantisBT: Reflected XSS in admin/install.php via unescaped printf
Critical Also affects mantisbt/mantisbt
GHSA-77x8-3v3h-hrhv
MantisBT: Reflected XSS in admin/install.php
Critical Also affects mantisbt/mantisbt
GHSA-m7ph-9558-mrx3
MantisBT: REST API unauthorized Issue status change
Medium Also affects mantisbt/mantisbt
GHSA-v84x-qvhg-f36r
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
High Also affects mantisbt/mantisbt
GHSA-c2xg-qjqw-2v98
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
Critical Also affects mantisbt/mantisbt
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor