GHSA-6JH4-47V2-4G37中危已审查

MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

OSV 1.4.0 · github-reviewed · 修改于 2026-06-09 07:20

发布时间

2026-05-12 03:35

GitHub 审查时间

2026-05-12 03:35

NVD 发布时间

2026-05-23 04:16

源文件

advisories/github-reviewed/2026/05/GHSA-6jh4-47v2-4g37/GHSA-6jh4-47v2-4g37.json

公告说明

Improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML.

While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.

Impact

Cross-site scripting (XSS).

Patches

b1ebc57763f104eb5f541b7b4d1ce6948168abd9

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

受影响的软件包

Packagist

mantisbt/mantisbt

ECOSYSTEM

标识信息

别名 / CVE

CVE-2026-40598

CWE

CWE-79

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-6jh4-47v2-4g37",
  "aliases": [
    "CVE-2026-40598"
  ],
  "details": "Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject HTML.\n\nWhile this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.\n\n### Impact\nCross-site scripting (XSS).\n\n### Patches\n- b1ebc57763f104eb5f541b7b4d1ce6948168abd9\n\n### Workarounds\nNone\n\n### Credits\nThanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.",
  "summary": "MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.28.2"
            }
          ]
        }
      ],
      "package": {
        "name": "mantisbt/mantisbt",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 2.28.1"
      }
    }
  ],
  "modified": "2026-06-08T23:20:26Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-05-11T19:35:01Z",
  "references": [
    {
      "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40598",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/mantisbt/mantisbt/commit/b1ebc57763f104eb5f541b7b4d1ce6948168abd9",
      "type": "WEB"
    },
    {
      "url": "https://github.com/mantisbt/mantisbt",
      "type": "PACKAGE"
    },
    {
      "url": "https://mantisbt.org/bugs/view.php?id=37017",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-22T20:16:34Z",
    "github_reviewed_at": "2026-05-11T19:35:01Z"
  }
}