CVE-2020-25830

An issue was discovered in MantisBT before 2.24.3

published September 30, 2020

CVSS
—
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01682 · 76.8th percentile
Published
2020-09-30T20:33Z
EPSS history
Timeline
  • 30 SEP 20:33Z
    An issue was discovered in MantisBT before 2.24.3
    cvelistv5