{"id":"CVE-2018-16514","published":"2019-06-20T13:18:36Z","modified":"2024-08-05T10:24:32Z","title":"A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page…","vendor":null,"product":null,"tier":"tail","description":{"text":"A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00891,"percentile":0.59302,"provenance":"source"},"cwes":[],"references":[{"url":"https://mantisbt.org/bugs/view.php?id=24731","tags":["x_refsource_MISC"]}],"priority":{"score":11.9,"factors":[{"name":"EPSS percentile","points":11.86}]},"affected":[{"ecosystem":"Packagist","package":"mantisbt/mantisbt","vulnerableRanges":[">=2.1.0, <2.17.1"],"patched":["2.17.1"],"from":["GHSA-3qv7-98vm-xx2v"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-8325","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mantisbt-mantisbt-cve-2018-13055","parents":[{"from":"CVE-2018-13055","to":"CVE-2018-16514","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.","from":"CVE.org","in":"CVE-2018-16514"},{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.15.1","toFixed":"2.17.1","daysApart":321},{"kind":"same-code","provenance":"machine","files":["core/filter_form_api.php"],"commits":["https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a","https://github.com/mantisbt/mantisbt/commit/66091a42626631a3063774eb0fb8a4218ab22fd4"],"basis":"shared function","functions":["filter_form_draw_inputs"]},{"kind":"similar","provenance":"machine","score":0.79,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2018-16514","to":"CVE-2020-16266","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/filter_form_api.php"],"commits":["https://github.com/mantisbt/mantisbt/commit/66091a42626631a3063774eb0fb8a4218ab22fd4","https://github.com/mantisbt/mantisbt/commit/9ef8f23a8119221d010251112b1255630a46d903"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-12062","published":"2017-08-01","fixed":"2.5.2","kev":false},{"cve":"CVE-2018-13055","published":"2018-08-03","fixed":"2.15.1","kev":false},{"cve":"CVE-2018-14504","published":"2018-08-03","fixed":"2.15.1","kev":false},{"cve":"CVE-2018-16514","published":"2019-06-20","fixed":"2.17.1","kev":false},{"cve":"CVE-2018-17782","published":"2018-10-30","fixed":"2.17.2","kev":false},{"cve":"CVE-2018-17783","published":"2018-10-30","fixed":"2.17.2","kev":false},{"cve":"CVE-2019-15074","published":"2019-08-21","fixed":"2.21.2","kev":false}],"package":"Packagist:mantisbt/mantisbt"}}