CVE-2024-34081— MantisBT Cross-site Scripting vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-34081
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MantisBT Cross-site Scripting vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
MantisBT 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MantisBT是MantisBT团队的一套基于Web的开源缺陷跟踪系统。该系统以Web操作的形式提供项目管理及缺陷跟踪服务。 MantisBT 2.26.2之前版本存在安全漏洞，该漏洞源于存在跨站脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-34081
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-34081
请登录查看更多情报信息。
- https://mantisbt.org/bugs/view.php?id=34432x_refsource_MISC
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-wgx7-jp56-65mqx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2024-34081
Same Patch Batch · mantisbt · 2024-05-13 · 3 CVEs total
| CVE-2024-34077 | 7.3 HIGH | MantisBT user account takeover in the signup/reset password process |
| CVE-2024-34080 | 5.3 MEDIUM | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
IV. Related Vulnerabilities
Same product: mantisbt
- CVE-2026-33548
MantisBT has Stored HTML Injection / XSS when displaying Tag - CVE-2026-33517
MantisBT Vulnerable to Stored HTML Injection in Tag Delete C - CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability - CVE-2025-62520
MantisBT unauthorized disclosure of private project column c - CVE-2025-55155
MantisBT: Authentication bypass for some passwords due to PH
Same vendor: mantisbt
- CVE-2026-33548
MantisBT has Stored HTML Injection / XSS when displaying Tag - CVE-2026-33517
MantisBT Vulnerable to Stored HTML Injection in Tag Delete C - CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability - CVE-2025-62520
MantisBT unauthorized disclosure of private project column c - CVE-2025-55155
MantisBT: Authentication bypass for some passwords due to PH
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2024-34081
No comments yet