Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2019-15074: MantisBT Timeline Feature Allows Malicious Code Execution
CVE-2019-15074 · published 7 years ago
Summary
The Timeline feature in MantisBT has a security flaw that can let hackers execute malicious code when a specific type of file is uploaded. This can happen when anyone views a page with the affected issue. To fix this, update to the latest version of MantisBT or apply a patch if available.
What to do
- Update mantisbt mantisbt to version 2.21.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | mantisbt | mantisbt |
< 2.21.2 Fix: upgrade to 2.21.2
|
| – | mantisbt | mantisbt |
>= 2.13.0, <= 2.21.1 cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* |
Original advisory text
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after upl...
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 Aug 2019
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta