|
|
Thanks for your bug report. We will look into this ASAP.
- Did you already request a CVE id for the vulnerability ? If not, we can take care of it.
- How would you like to be credited for the finding ?
|
|
|
|
I confirm the vulnerability, but only when CSP is disabled. |
|
|
|
@elandais Please confirm that the attached patch fully addresses the issue you reported.
0001-Fix-XSS-in-bug_change_status_page.php.patch (897 bytes)
From 658f32443b4aaa1c3285eaf970d0416ca7a020a5 Mon Sep 17 00:00:00 2001
From: Damien Regad <dregad@mantisbt.org>
Date: Tue, 7 Mar 2017 12:34:16 +0100
Subject: [PATCH] Fix XSS in bug_change_status_page.php
The value of the change_type parameter was not encoded before being
displayed as a hidden input.
This vulnerability was reported by Etienne Landais.
Fixes #22486
---
bug_change_status_page.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/bug_change_status_page.php b/bug_change_status_page.php
index 4e1c6fc..bc23ce6 100644
--- a/bug_change_status_page.php
+++ b/bug_change_status_page.php
@@ -385,7 +385,7 @@ layout_page_begin();
</tbody>
</table>
-<input type="hidden" name="action_type" value="<?php echo $f_change_type; ?>" />
+<input type="hidden" name="action_type" value="<?php echo string_attribute( $f_change_type ); ?>" />
</div>
</div>
--
1.9.1
|
|
|
|
I confirm that the attached parch fully adresses the issue I reported.
Thanks |
|
|
|
@elandais you did not answer my questions in 0022486:0055944 |
|
|
|
- I did not request a CVE for the vulnerability. If you can take care of it, it would be great. thanks
- I'm new here, i don't know how to answer to this question
|
|
dregad
2017-03-08 05:42
developer
~0055983
Last edited: 2017-03-08 08:12
|
How would you like to be credited for the finding ?
I'm new here, i don't know how to answer to this question
Security researchers and firms generally like to be credited with their findings in the CVE report, and often request a specific format for such credit, with an e-mail address, web site, reference ID, etc (see example) |
|
|
|
it's ok, we don't need to be credited for this discovery.
Thanks |
|
|
|
Git blame indicates that this bug was introduced in MantisBT master f591e7b6 - 1.3.0-beta.3 so targeting 1.3.7 |
|
|
|
CVE Request 304568 for CVE ID Request sent |
|
