GHSA-qgrr-f26j-87vfMediumCVSS 4.8

MantisBT XXS where a Custom Field with a crafted Regular Expression property is used

Published
May 24, 2022
Last Modified
May 29, 2025

🔗 CVE IDs covered (1)

CVE-2020-25288 →

📋 Description

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.

🎯 Affected products1

  • composer/mantisbt/mantisbt:>= 2.23.0, < 2.24.3

🔗 References (5)