MantisBT Cross-site Scripting vulnerability
Date: 2022-05
Affected: composer/mantisbt/mantisbt
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2010-2574
CWE: CWE-79

Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action.


Mitigations:

Architectural layers (MAESTRO):