Re: CVE Request: XSS vulnerability in MantisBT 1.2.13

[Damien Regad <dregad () mantisbt org>]

On 2014-11-15 16:30, Paul Richards wrote:
> However, I believe the fix for first issue to be incorrect (hence helping
> me misunderstanding the initial issue):
>
> The initial fix adds a string_display_line call to an <input> box. Given
> that this processes the string for display in html, and there is a
> string_attribute api call for handling data for display in a text box, I
> believe that the fix for the other  issue is incorrect and
> that string_attribute should be used instead of string_display_line (which
> may do other formatting to the string which may be undesirable when editing
> configuration values).

Thanks for catching this mistake Paul. I have:

- reverted the original fix commit with incorrect string_display_line()
  https://github.com/mantisbt/mantisbt/commit/1bdc16e5

- pushed a new fix with string_attribute()
  https://github.com/mantisbt/mantisbt/commit/49c3d089

@CVE assign authority - please let me know the ID for this issue, and 
update the data from my initial request accordingly.