{"id":"CVE-2018-13055","published":"2018-08-03T18:00:00Z","modified":"2024-08-05T08:52:49Z","title":"A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through…","vendor":null,"product":null,"tier":"tail","description":{"text":"A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0151,"percentile":0.7437,"provenance":"source"},"cwes":[],"references":[{"url":"https://mantisbt.org/blog/archives/mantisbt/602","tags":["x_refsource_CONFIRM"]},{"url":"http://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a","tags":["x_refsource_CONFIRM"]},{"url":"https://mantisbt.org/bugs/view.php?id=24580","tags":["x_refsource_CONFIRM"]}],"priority":{"score":14.9,"factors":[{"name":"EPSS percentile","points":14.87}]},"affected":[{"ecosystem":"Packagist","package":"mantisbt/mantisbt","vulnerableRanges":[">=2.1.0, <2.15.1"],"patched":["2.15.1"],"from":["GHSA-mjp7-97w4-jwhc"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-5005","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mantisbt-mantisbt-cve-2018-13055","children":[{"from":"CVE-2018-13055","to":"CVE-2018-16514","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.","from":"CVE.org","in":"CVE-2018-16514"},{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.15.1","toFixed":"2.17.1","daysApart":321},{"kind":"same-code","provenance":"machine","files":["core/filter_form_api.php"],"commits":["https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a","https://github.com/mantisbt/mantisbt/commit/66091a42626631a3063774eb0fb8a4218ab22fd4"],"basis":"shared function","functions":["filter_form_draw_inputs"]},{"kind":"similar","provenance":"machine","score":0.79,"basis":"same package + description similarity"}]},{"from":"CVE-2018-13055","to":"CVE-2020-16266","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/filter_form_api.php"],"commits":["https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a","https://github.com/mantisbt/mantisbt/commit/9ef8f23a8119221d010251112b1255630a46d903"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-7620","published":"2017-05-21","fixed":"2.4.1","kev":false},{"cve":"CVE-2017-12061","published":"2017-08-01","fixed":"2.5.2","kev":false},{"cve":"CVE-2017-12062","published":"2017-08-01","fixed":"2.5.2","kev":false,"link":{"from":"CVE-2017-12062","to":"CVE-2018-13055","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.5.2","toFixed":"2.15.1","daysApart":367}]}},{"cve":"CVE-2018-13055","published":"2018-08-03","fixed":"2.15.1","kev":false},{"cve":"CVE-2018-14504","published":"2018-08-03","fixed":"2.15.1","kev":false},{"cve":"CVE-2018-16514","published":"2019-06-20","fixed":"2.17.1","kev":false},{"cve":"CVE-2018-17782","published":"2018-10-30","fixed":"2.17.2","kev":false}],"package":"Packagist:mantisbt/mantisbt"}}