Thanks for the heads up, we'll look into it.

EDIT: After a quick look at changes from 3 to 4, and considering our use of the ACE admin template, this is no small undertaking... don't hold your breath ;-)

After a quick look at changes from 3 to 4, and considering our use of the ACE admin template, this is no small undertaking

Using 3.4.0 might be an option
https://github.com/twbs/bootstrap/commits/v3.4.0-dev
From what I see, they seem to fix security issues in this branch
https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d

Using 3.4.0 might be an option

Assuming they ever release it...
https://github.com/twbs/bootstrap/issues/25679

Would you please edit my issue's title in order to change it to "Fix CVE-2018-14040, CVE-2018-14041, CVE-2018-14042" ? (which is more relevant)

PR https://github.com/mantisbt/mantisbt/pull/1432

Thanks !!

@atrol should this be applied 2.19.1?

@vboctor this is a security issue, but I did not investigate if there is a way to use the leak in MantisBT.
I don't expect that backporting to 2.19.1 will break something, but I don't have time for tests.

So the answer is: Maybe ;-)