Mantis Bug Tracker Stored Cross-Site Scripting Vulnerability in Tag Deletion Confirmation

A stored cross-site scripting vulnerability has been identified in Mantis Bug Tracker (MantisBT) version 2.28.0. The issue arises in the tag deletion process, where improper escaping of the tag name in the confirmation message allows for HTML injection. If the Content Security Policy (CSP) settings permit, this could lead to the execution of arbitrary JavaScript. The vulnerability has been patched in version 2.28.1.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to MantisBT version 2.28.1 to address this vulnerability. Alternatively, the language files can be manually edited to remove the sprintf placeholder '%1$s' from the '$s_tag_delete_message' string.