A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter. Upstream bug: http://www.mantisbt.org/bugs/view.php?id=22486 Upstream patches: https://github.com/mantisbt/mantisbt/commit/a2d90ecabf3bcf3aa22ed9dbbecfd3d37902956f https://github.com/mantisbt/mantisbt/commit/c272c3f65da9677e505ff692b1f1e476b3afa56e
Created mantis tracking bugs for this issue: Affects: epel-5 [bug 1431181] Affects: fedora-all [bug 1431180]
So, according to the upstream bug discussion, the bug was introduced during 1.3.x development. e.g. 1.2.x is NOT affected. http://www.mantisbt.org/bugs/view.php?id=22486#c55996