Description
Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mantis | 0.19.2-5sarge4.1 | DSA-1133-1 |
Advisories 1
- DSA-1133-1 mantis - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- mantis-configdefaultsinc-xss(24585) vdb-entry
- ADV-2006-0485 vdb-entry
- 21400 third-party-advisory
- DSA-1133 vendor-advisory
- 16561 vdb-entry