CVE-2020-35571

2021-02-2202:23:53

mitre

www.cve.org

mantisbt

unsanitized custom field

csp settings

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

33.8%

JSON

An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.

References

mantisbt.org/bugs/view.php?id=27768