MantisBT: XSS in view_all_bug_page.php

[Damien Regad <dregad () mantisbt org>]

Greetings,

Please assign a CVE ID for the following issue.

Description
-----------
An XSS vulnerability was discovered in MantisBT's Filter API, affecting 
the View Issues page. It is caused by unescaped output of the 
'view_type' GPC parameter, and can be exploited as follows:

http://example.com/mantis/view_all_bug_page.php?view_type=";><script>alert('XSS');</script>

To resolve the issue, the parameter's value is sanitized prior to being 
stored in the filter, ensuring only authorized values 'simple' and 
'advanced' are saved, and subsequently printed on the hidden form field.

Affected versions
-----------------
- >= 1.2.0 (possibly older releases as well - not tested)
- >= 1.3.0-beta.1
- >= 2.0.0-beta.1

Fixed in versions:
------------------
- 1.3.1
- 2.0.0-beta.2

As of this writing, these have not been released yet, but both should be 
available in the coming days. Until then, installations should be 
patched manually.

Please note that MantisBT 1.2.20 was the last release in the legacy 
1.2.x series, which is no longer supported; this vulnerability will 
therefore NOT be patched in 1.2. All installations are strongly advised 
to upgrade to MantisBT 1.3.

Patch
-----
See Github [1]

Credits
-------
The issue was discovered by Will Dollman of Netcraft Ltd, and fixed by 
Damien Regad (MantisBT Developer).

References
----------
Further details available in our issue tracker [2]


Best regards,
D. Regad
MantisBT Developer
http://www.mantisbt.org


[1] https://github.com/mantisbt/mantisbt/commit/7086c2d8
[2] https://mantisbt.org/bugs/view.php?id=21611