CVE-2024-23830: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

February 20, 2024

MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user’s email address and username can hijack the user’s account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define $g_path as appropriate in config_inc.php.

References

github.com/advisories/GHSA-mcqj-7p29-9528
github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744
github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528

Code Behaviors & Features

Detect and mitigate CVE-2024-23830 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →