What’s Vulnerable › Vulnerabilities

CVE-2020-25830

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-30 · updated 2026-06-17
• Weakness: CWE-79

Description

An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.

Affected products

• mantisbt: before 2.24.3 — fixed in 2.24.3

How to fix

Upgrade to a fixed version: mantisbt 2.24.3. Check the vendor advisory for mitigations.

References

• http://github.com/mantisbt/mantisbt/commit/8c6f4d8859785b67fb80ac65100ac5259ed9237d
• https://mantisbt.org/bugs/view.php?id=27304
• http://github.com/mantisbt/mantisbt/commit/8c6f4d8859785b67fb80ac65100ac5259ed9237d
• https://mantisbt.org/bugs/view.php?id=27304

Get alerted when CVE-2020-25830 or the next vulnerability affects your stack