CVE request: XSS in MantisBT

[Damien Regad <dregad () mantisbt org>]

Greetings,

Please assign a CVE ID for the following issue

Description:

The MantisBT Configuration Report (adm_config_report.php) did not 
properly sanitize the form variables used when saving a filter, allowing 
an attacker to embed JavaScript code which would be executed in the 
client's browser when displaying the page.

Affected versions:
- >= 1.2.13
- 1.3.0-beta.1

Fixed in versions:
- 1.2.20 (not yet released)
- 1.3.0-beta.2 (not yet released)

Patch:
See Github [1]

Credit:
This vulnerability was discovered by Fortinet's FortiGuard Labs 
(reference FG-VD-15-008 [2])
The issue was fixed by Damien Regad (MantisBT Developer).

References:
Further details will be available in our issue tracker [2] once this 
goes public.

[1] https://github.com/mantisbt/mantisbt/commit/6defeed5 (1.2.x)
    https://github.com/mantisbt/mantisbt/commit/3c6f6e56 (1.3.x)
[2] http://www.fortiguard.com/advisory/UpcomingAdvisories.html
[3] https://www.mantisbt.org/bugs/view.php?id=19301