From ${URL}: Greetings, Please assign a CVE ID for the following issue Description: The MantisBT Configuration Report (adm_config_report.php) did not properly sanitize the form variables used when saving a filter, allowing an attacker to embed JavaScript code which would be executed in the client's browser when displaying the page. Affected versions: - >= 1.2.13 - 1.3.0-beta.1 Fixed in versions: - 1.2.20 (not yet released) - 1.3.0-beta.2 (not yet released) Patch: See Github [1] Credit: This vulnerability was discovered by Fortinet's FortiGuard Labs (reference FG-VD-15-008 [2]) The issue was fixed by Damien Regad (MantisBT Developer). References: Further details will be available in our issue tracker [2] once this goes public. [1] https://github.com/mantisbt/mantisbt/commit/6defeed5 (1.2.x) https://github.com/mantisbt/mantisbt/commit/3c6f6e56 (1.3.x) [2] http://www.fortiguard.com/advisory/UpcomingAdvisories.html [3] https://www.mantisbt.org/bugs/view.php?id=19301
Multiple vulnerabilities spread across 9 different bugs. No movement from maintainers in over a year.
Package removed
