CVE-2023-49802

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
mantisbt-plugins	LinkedCustomFields	< 2.0.1

References

https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286Patch
https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10Issue Tracking, Patch
https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11Issue Tracking
https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhwVendor Advisory
https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286Patch
https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10Issue Tracking, Patch
https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11Issue Tracking
https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhwVendor Advisory

Timeline

Published: Dec 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-498037.5@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware ope CVE-2023-498047.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma,CVE-2023-498058.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it CVE-2023-498075.4Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exp CVE-2023-498096.5Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to th CVE-2023-49815.4Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.CVE-2023-498106.5A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.CVE-2023-498127.5Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Ph CVE-2023-498136.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo CVE-2023-498147.2Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.CVE-2023-4981510.0Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0 CVE-2023-498168.8Cross-Site Request Forgery (CSRF) vulnerability in Innovative Solutions Fix My Feed RSS Repair.This issue affects Fix My Feed RSS Repair: fr