Description
Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | mantis | 1.2.18-1 | DSA-3120-1 |
Advisories 1
- DSA-3120-1 mantis - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://www.mantisbt.org/bugs/view.php?id=17890
- https://github.com/mantisbt/mantisbt/commit/511564cc
- 62101 third-party-advisory
- [oss-security] 20141201 CVE Request: Multiple XSS vulnerabilities in MantisBT mailing-list
- [oss-security] 20141204 Re: CVE Request: Multiple XSS vulnerabilities in MantisBT mailing-list
- DSA-3120 vendor-advisory