CVE-2020-8981

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-13 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.

Affected products

mantisbt Source Integration: before 1.6.2; from 2.0.0 before 2.3.1 — fixed in 1.6.2, 2.3.1

How to fix

Upgrade to a fixed version: mantisbt Source Integration 1.6.2, 2.3.1. Check the vendor advisory for mitigations.

References

https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0
https://github.com/mantisbt-plugins/source-integration/issues/338
https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0
https://github.com/mantisbt-plugins/source-integration/issues/338

Get alerted when CVE-2020-8981 or the next vulnerability affects your stack