CVE-2024-34081

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
mantisbt	mantisbt	< 2.26.2

References

https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739bePatch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-wgx7-jp56-65mqPatch, Vendor Advisory
https://mantisbt.org/bugs/view.php?id=34432Issue Tracking, Mitigation, Vendor Advisory
https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739bePatch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-wgx7-jp56-65mqPatch, Vendor Advisory
https://mantisbt.org/bugs/view.php?id=34432Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-340829.9Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files CVE-2024-340835.4aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept ext CVE-2024-340847.5Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before CVE-2024-340857.8A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamce CVE-2024-340867.8A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamce CVE-2024-340879.8An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve r CVE-2024-340887.5In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In case CVE-2024-340895.4An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authentica CVE-2024-340905.4An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in CVE-2024-340915.4An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authentica CVE-2024-340928.8An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing sessio CVE-2024-340935.3An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated att