mantisbt/mantisbt (Packagist)
Advisories
87
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.28.4 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require mantisbt/mantisbt:^2.28.4Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-h2wf-967x-gxvw MantisBT: Stored XSS in print_all_bug_page_word.php |
High | < 2.28.4 | 2.28.4 |
| GHSA-4vpf-w7qv-5h3q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs |
Medium | < 2.28.4 | 2.28.4 |
| GHSA-3v2j-6fw9-f57c MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters |
Medium | < 2.28.4 | 2.28.4 |
| GHSA-vcrw-4xvv-jh49 MantisBT: Reflected XSS in admin/install.php via unescaped printf |
Critical | < 2.28.4 | 2.28.4 |
| GHSA-77x8-3v3h-hrhv MantisBT: Reflected XSS in admin/install.php |
Critical | < 2.28.4 | 2.28.4 |
| GHSA-m7ph-9558-mrx3 MantisBT: REST API unauthorized Issue status change |
Medium | >= 2.8.0, < 2.28.4 | 2.28.4 |
| GHSA-v84x-qvhg-f36r MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php |
High | >= 1.3.0, < 2.28.4 | 2.28.4 |
| GHSA-c2xg-qjqw-2v98 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator |
Critical EPSS 0.69% |
< 2.28.4 | 2.28.4 |
| GHSA-mw6p-33vw-46cc MantisBT: SQL Injection via history_order Configuration Value |
High | < 2.28.4 | 2.28.4 |
| GHSA-p6fr-rxq7-xcg8 MantisBT Vulnerable to Stored XSS in File Download |
High EPSS 0.35% |
< 2.28.2 | 2.28.2 |
| GHSA-7mqj-8gj2-cg59 MantisBT has Stored XSS on Move Attachments Admin Page |
High EPSS 0.30% |
>= 1.3.0, < 2.28.2 | 2.28.2 |
| GHSA-pw5x-2mf9-3xc8 MantisBT has a Private Bugnote Attachment Content Leak via REST API |
High EPSS 0.26% |
>= 2.23.0, < 2.28.2 | 2.28.2 |
| GHSA-pq86-j2c2-47f6 MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API |
Medium EPSS 0.26% |
< 2.28.2 | 2.28.2 |
| GHSA-j7v9-f46r-2rp4 MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field |
Medium EPSS 0.28% |
>= 1.0.0, < 2.28.2 | 2.28.2 |
| GHSA-f633-865q-2mhh MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column |
High EPSS 0.42% |
>= 2.1.0, < 2.28.2 | 2.28.2 |
| GHSA-6jh4-47v2-4g37 MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page |
Medium EPSS 0.45% |
< 2.28.2 | 2.28.2 |
| GHSA-9c3j-xm6v-j7j3 MantisBT has a Content Security Policy bypass via attachments |
High EPSS 0.50% |
< 2.28.2 | 2.28.2 |
| GHSA-j3v9-553h-x28j MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference |
High EPSS 0.42% |
>= 2.11.0, < 2.28.2 | 2.28.2 |
| GHSA-qj6w-v29q-4rgx MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values |
Medium EPSS 0.23% |
< 2.28.2 | 2.28.2 |
| GHSA-crmx-4p49-46m2 MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked |
Medium EPSS 0.37% |
< 2.28.2 | 2.28.2 |
| GHSA-h4x5-gvx6-3rwc MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API |
Medium EPSS 0.25% |
< 2.28.2 | 2.28.2 |
| GHSA-rmp5-5jj7-gmvf MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue |
Medium EPSS 0.36% |
< 2.28.2 | 2.28.2 |
| GHSA-ggw7-9675-6v4v MantisBT has an authorization bypass in private issue monitoring |
Medium EPSS 0.36% |
>= 2.26.1, < 2.28.2 | 2.28.2 |
| GHSA-fvjf-68wh-rwp2 MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form |
High EPSS 0.44% |
< 2.28.2 | 2.28.2 |
| GHSA-frf7-jhp9-jxm6 MantisBT Vulnerable to Privilege Escalation from Manager to Administrator |
Medium EPSS 0.43% |
< 2.28.2 | 2.28.2 |
| GHSA-68w5-w573-q2r8 MantisBT Has Authorization Bypass in Global Profile Creation |
Medium EPSS 0.34% |
>= 2.28.0, < 2.28.2 | 2.28.2 |
| GHSA-73vx-49mv-v8w5 MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline |
Medium EPSS 0.20% |
>= 2.28.0, < 2.28.2 | 2.28.2 |
| GHSA-fh48-f69w-7vmp MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation |
Medium EPSS 0.25% |
>= 2.28.0, < 2.28.1 | 2.28.1 |
| GHSA-phrq-pc6r-f6gh MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL |
Critical EPSS 1.76% |
< 2.28.1 | 2.28.1 |
| GHSA-g582-8vwr-68h2 MantisBT unauthorized disclosure of private project column configuration |
Medium EPSS 0.26% |
< 2.27.2 | 2.27.2 |
| GHSA-q747-c74m-69pr MantisBT lacks verification when changing a user's email address |
Medium EPSS 0.16% |
< 2.27.2 | 2.27.2 |
| GHSA-r3jf-hm7q-qfw5 MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length |
High EPSS 0.41% |
< 2.27.2 | 2.27.2 |
| GHSA-4v8w-gg5j-ph37 MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling |
Critical EPSS 0.34% |
< 2.27.2 | 2.27.2 |
| GHSA-h5q3-fjp4-2x7r MantisBT vulnerable to information disclosure with user profiles |
Medium EPSS 0.53% |
< 2.26.4 | 2.26.4 |
| GHSA-wgx7-jp56-65mq Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting |
Medium EPSS 0.64% |
< 2.26.2 | 2.26.2 |
| GHSA-99jc-wqmr-ff2q MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 0.70% |
< 2.26.2 | 2.26.2 |
| GHSA-93x3-m7pw-ppqm Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process |
High EPSS 1.19% |
< 2.26.2 | 2.26.2 |
| GHSA-mcqj-7p29-9528 MantisBT Host Header Injection vulnerability |
High EPSS 0.96% |
< 2.26.1 | 2.26.1 |
| GHSA-v642-mh27-8j6m MantisBT may disclose project names to unauthorized users |
Medium EPSS 0.74% |
< 2.25.8 | 2.25.8 |
| GHSA-hf4x-6h87-hm79 MantisBT may expose private issues' summaries to unauthorized users |
Medium EPSS 0.61% |
< 2.25.6 | 2.25.6 |
| GHSA-qghg-v7xv-q98q MantisBT XSS through crafted SVG documents in file_download.php |
Medium EPSS 0.95% |
< 2.25.5 | 2.25.5 |
| GHSA-52cx-vphc-jmjm MantisBT allows XSS in manage_custom_field_edit_page.php |
Medium EPSS 1.82% |
< 2.25.2 | 2.25.2 |
| GHSA-cvrm-cr3m-qj92 MantisBT XSS in manage_custom_field_update.php |
Medium EPSS 0.66% |
< 2.25.0 | 2.25.0 |
| GHSA-pgg9-mmcg-8mxp MantisBT Incorrect Authorization in bug_actiongroup_page.php |
Medium EPSS 0.90% |
< 2.24.4 | 2.24.4 |
| GHSA-f38c-wxp6-8xjv MantisBT Missing Authorization access check in bug_actiongroup.php |
Medium EPSS 1.12% |
< 2.24.4 | 2.24.4 |
| GHSA-qpj5-f88q-x7px MantisBT Insecure Storage in manage_proj_edit_page.php |
Medium EPSS 1.06% |
< 2.24.4 | 2.24.4 |
| GHSA-7j8m-fm49-xgmg MantisBT Incorrect Authorization for bug_revision_view_page.php check |
High EPSS 1.62% |
< 2.24.4 | 2.24.4 |
| GHSA-49w9-82cj-xr48 MantisBT SQL Injection via mc_project_get_users function |
Medium EPSS 4.78% |
< 2.24.4 | 2.24.4 |
| GHSA-2pm7-q8pc-xhvq MantisBT HTML Injection vulnerability |
Medium EPSS 1.68% |
< 2.24.3 | 2.24.3 |
| GHSA-xjmx-cprh-646r MantisBT unauthorized users able to access private files |
Medium EPSS 0.94% |
< 2.24.3 | 2.24.3 |
| GHSA-qgrr-f26j-87vf MantisBT XXS where a Custom Field with a crafted Regular Expression property is used |
Medium EPSS 1.49% |
>= 2.23.0, < 2.24.3 | 2.24.3 |
| GHSA-4rrc-5vp6-m3f6 MantisBT XSS issue on the view_all_bug_page.php |
Medium EPSS 1.18% |
>= 2.1.0, < 2.24.2 | 2.24.2 |
| GHSA-p495-jrpq-p66g MantisBT XSS when uploading an attachment |
Medium EPSS 1.17% |
< 2.21.3 | 2.21.3 |
| GHSA-v23g-wjvq-2fpf MantisBT Remote Code Execution |
High EPSS 30.00% |
>= 2.0.0, < 2.22.1 | 2.22.1 |
| GHSA-v23g-wjvq-2fpf MantisBT Remote Code Execution |
High EPSS 30.00% |
< 1.3.20 | 1.3.20 |
| GHSA-gg4j-279j-22ph MantisBT allows cross-site scripting (XSS) via crafted filename |
Medium EPSS 2.07% |
< 2.21.2 | 2.21.2 |
| GHSA-3qv7-98vm-xx2v MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO |
Medium EPSS 0.89% |
>= 2.1.0, < 2.17.1 | 2.17.1 |
| GHSA-8vx9-hcvq-gfv8 MantisBT XSS through weak CSP when using Gravatar plugin |
Medium EPSS 1.00% |
< 1.3.1 | 1.3.1 |
| GHSA-8vx9-hcvq-gfv8 MantisBT XSS through weak CSP when using Gravatar plugin |
Medium EPSS 1.00% |
>= 2.0.0-beta.1, < 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-9x76-mp7r-2xc5 MantisBT vulnerable to CSRF and Open Redirect attacks |
Medium EPSS 1.36% |
< 1.3.11 | 1.3.11 |
| GHSA-9x76-mp7r-2xc5 MantisBT vulnerable to CSRF and Open Redirect attacks |
Medium EPSS 1.36% |
>= 2.4.0, < 2.4.1 | 2.4.1 |
| GHSA-9x76-mp7r-2xc5 MantisBT vulnerable to CSRF and Open Redirect attacks |
Medium EPSS 1.36% |
>= 2.0.0, < 2.3.3 | 2.3.3 |
| GHSA-8r2m-qhff-jm2c MantisBT XSS via my_view_page.php and view_user_page.php |
Medium EPSS 1.75% |
>= 2.3.0, < 2.3.2 | 2.3.2 |
| GHSA-4w6c-3hcx-rfj5 MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php |
Medium EPSS 57.32% |
>= 2.2.0, < 2.2.3 | 2.2.3 |
| GHSA-v7qf-22rw-chph MantisBT XSS via adm_config_report.php's action parameter |
Medium EPSS 0.93% |
< 1.3.8 | 1.3.8 |
| GHSA-v7qf-22rw-chph MantisBT XSS via adm_config_report.php's action parameter |
Medium EPSS 0.93% |
>= 2.0.0, < 2.1.2 | 2.1.2 |
| GHSA-v7qf-22rw-chph MantisBT XSS via adm_config_report.php's action parameter |
Medium EPSS 0.93% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-x53v-v9xp-gf6g MantisBT XSS via move_attachments_page.php |
Medium EPSS 0.93% |
< 1.3.9 | 1.3.9 |
| GHSA-x53v-v9xp-gf6g MantisBT XSS via move_attachments_page.php |
Medium EPSS 0.93% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-x53v-v9xp-gf6g MantisBT XSS via move_attachments_page.php |
Medium EPSS 0.93% |
>= 2.2.0, < 2.2.3 | 2.2.3 |
| GHSA-4w6c-3hcx-rfj5 MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php |
Medium EPSS 57.32% |
>= 2.1.0, < 2.1.3 | 2.1.3 |
| GHSA-4w6c-3hcx-rfj5 MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php |
Medium EPSS 57.32% |
< 1.3.9 | 1.3.9 |
| GHSA-w93w-rx52-24qh MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php |
Medium EPSS 3.90% |
>= 2.0.0, < 2.5.2 | 2.5.2 |
| GHSA-74gh-5j33-vg4w MantisBT allows XSS on the Edit Filter page via crafted filter name |
Medium EPSS 1.63% |
>= 2.0.0, < 2.15.1 | 2.15.1 |
| GHSA-mjp7-97w4-jwhc MantisBT allows XSS via View Filters page |
Medium EPSS 1.51% |
>= 2.1.0, < 2.15.1 | 2.15.1 |
| GHSA-74x7-mfvg-h2wf MantisBT Cross-site Scripting vulnerability |
Low EPSS 1.80% |
<= 1.2.2 | No fix yet |
| GHSA-ggjm-7m5f-7xjv MantisBT allows XSS via the Manage Filter page |
Medium EPSS 0.69% |
>= 2.1.0, < 2.17.2 | 2.17.2 |
| GHSA-gcqw-45xq-xc63 MantisBT allows XSS via Edit Filter page |
Medium EPSS 0.69% |
>= 2.1.0, < 2.17.2 | 2.17.2 |
| GHSA-252r-f55f-ff34 MantisBT allows arbitrary password reset |
High EPSS 91.20% |
>= 2.3.0, < 2.3.1 | 2.3.1 |
| GHSA-252r-f55f-ff34 MantisBT allows arbitrary password reset |
High EPSS 91.20% |
>= 1.3.0-rc.2, < 1.3.10 | 1.3.10 |
| GHSA-252r-f55f-ff34 MantisBT allows arbitrary password reset |
High EPSS 91.20% |
>= 2.0.0, < 2.2.4 | 2.2.4 |
| GHSA-98xr-mmq5-vc5h MantisBT XSS allows unsanitized input via admin/install.php |
Medium EPSS 2.94% |
>= 2.0.0, < 2.5.2 | 2.5.2 |
| GHSA-98xr-mmq5-vc5h MantisBT XSS allows unsanitized input via admin/install.php |
Medium EPSS 2.94% |
< 1.3.12 | 1.3.12 |
| GHSA-wfg2-2wmw-6894 MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php |
Medium EPSS 5.17% |
<= 2.25.2 | No fix yet |
| GHSA-jm72-67rm-763j MantisBT Insufficient Session Expiration cookie string not reset after logout |
High EPSS 0.87% |
< 2.24.5 | 2.24.5 |
| GHSA-rg8f-5p7x-m6wv MantisBT CSV Injection unprivileged user access in csv_export.php |
High EPSS 0.98% |
< 2.25.3 | 2.25.3 |
| GHSA-rqgj-rqfr-5j6f MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php |
Medium EPSS 0.83% |
< 2.25.3 | 2.25.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor