{"id":"CVE-2020-16266","published":"2020-08-12T12:59:54Z","modified":"2024-08-04T13:37:54Z","title":"An XSS issue was discovered in MantisBT before 2.24.2","vendor":null,"product":null,"tier":"tail","description":{"text":"An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01178,"percentile":0.67584,"provenance":"source"},"cwes":[],"references":[{"url":"https://mantisbt.org/bugs/view.php?id=27056","tags":["x_refsource_CONFIRM"]},{"url":"https://mantisbt.org/blog/archives/mantisbt/665","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.5,"factors":[{"name":"EPSS percentile","points":13.52}]},"affected":[{"ecosystem":"Packagist","package":"mantisbt/mantisbt","vulnerableRanges":[">=2.1.0, <2.24.2"],"patched":["2.24.2"],"from":["GHSA-4rrc-5vp6-m3f6"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-8227","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mantisbt-mantisbt-cve-2018-13055","parents":[{"from":"CVE-2018-13055","to":"CVE-2020-16266","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/filter_form_api.php"],"commits":["https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a","https://github.com/mantisbt/mantisbt/commit/9ef8f23a8119221d010251112b1255630a46d903"],"basis":"rarely changed file"}]},{"from":"CVE-2018-16514","to":"CVE-2020-16266","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/filter_form_api.php"],"commits":["https://github.com/mantisbt/mantisbt/commit/66091a42626631a3063774eb0fb8a4218ab22fd4","https://github.com/mantisbt/mantisbt/commit/9ef8f23a8119221d010251112b1255630a46d903"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2019-15074","published":"2019-08-21","fixed":"2.21.2","kev":false},{"cve":"CVE-2019-15539","published":"2020-03-19","fixed":"2.21.3","kev":false},{"cve":"CVE-2019-15715","published":"2019-10-09","fixed":"2.22.1","kev":false,"link":{"from":"CVE-2019-15715","to":"CVE-2020-16266","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.22.1","toFixed":"2.24.2","daysApart":308}]}},{"cve":"CVE-2020-16266","published":"2020-08-12","fixed":"2.24.2","kev":false},{"cve":"CVE-2020-25288","published":"2020-09-30","fixed":"2.24.3","kev":false,"link":{"from":"CVE-2020-16266","to":"CVE-2020-25288","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.24.2","toFixed":"2.24.3","daysApart":49}]}},{"cve":"CVE-2020-25781","published":"2020-09-30","fixed":"2.24.3","kev":false,"link":{"from":"CVE-2020-16266","to":"CVE-2020-25781","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.24.2","toFixed":"2.24.3","daysApart":49}]}},{"cve":"CVE-2020-25830","published":"2020-09-30","fixed":"2.24.3","kev":false,"link":{"from":"CVE-2020-16266","to":"CVE-2020-25830","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:mantisbt/mantisbt","fromFixed":"2.24.2","toFixed":"2.24.3","daysApart":49},{"kind":"similar","provenance":"machine","score":0.35,"basis":"same package + description similarity"}]}}],"package":"Packagist:mantisbt/mantisbt"}}