CVE-2023-49802

MEDIUM

MantisBT LinkedCustomFields < 2.0.1 - Stored Cross-Site Scripting via Linked Custom Field

Title source: llm

Description

The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.

References (4)

Core 4

Core References

Vendor Advisory x_refsource_confirm

https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhw

Issue Tracking, Patch x_refsource_misc

https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10

Issue Tracking x_refsource_misc

https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11

Patch x_refsource_misc

https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286

View Patch ZIP pw:eip

Scores

CVSS v3 6.7

EPSS 0.0066

EPSS Percentile 47.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-79

Status published

Products (1)

mantisbt/linked_custom_fields < 2.0.1

Published Dec 11, 2023

Tracked Since Feb 18, 2026