Bug 1022246 (CVE-2013-4460)

Summary:	CVE-2013-4460 mantis: XSS flaw in account_sponsor_page.php
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	extras-orphan, giallu, sven
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:41:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2013-10-22 20:13:25 UTC

It was reported [1],[2] that an XSS flaw in Mantis' account_sponsor_page.php existed, where project names were not properly sanitized.  This could lead to the execution of malicious javascript when visiting that page if a malicious user had project manager permissions.

This exists in all versions of Mantis from 1.0.0 to 1.2.15 and is corrected in 1.2.16.  A patch for 1.2.x is available [3].

[1] http://www.mantisbt.org/bugs/view.php?id=16513
[2] http://seclists.org/oss-sec/2013/q4/152
[3] https://github.com/mantisbt/mantisbt/commit/ad929d486bad460e9bd23eeec1e1e4bf828b7cb4

Comment 1 Fedora Update System 2013-11-24 03:28:29 UTC

mantis-1.2.15-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 2 Fedora Update System 2013-11-24 03:44:41 UTC

mantis-1.2.15-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2013-11-24 03:51:39 UTC

mantis-1.2.15-3.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.