CVE-2020-16266

Katalog CVE

CVSS 5.4 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada mantisbt. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).

Rincian

Terbit di NVD

12 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mantisbt.org/blog/archives/mantisbt/665 release notes · advisory vendor
• https://mantisbt.org/bugs/view.php?id=27056 exploit · issue tracking · patch · advisory vendor