hitoshura25/cvefixes huggingface dataset:
CVE-2017-6799 (PHP, published 2017-03-10T10:59Z)
Description: value: A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
view_filters_page.php
Commit message: Fix XSS in view_filters_page.php

The value of the view_type parameter was not sanitized before being
displayed as a hidden input.

This vulnerability was reported by Etienne Landais.

Fixes #22497


Vulnerable code:
	<input type="hidden" name="view_type" value="<?php echo $f_view_type; ?>" />

Fixed code:
	<input type="hidden" name="view_type" value="<?php echo $t_filter['_view_type']; ?>" />
CVE-2017-7222 (PHP, published 2017-03-22T05:59Z)
Description: value: A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/layout_api.php
Commit message: Sanitize window title

The window title is not sanitized.  That is not an issue when CSP is enable (default),
but if disabled, it can execute javascript that is set by a user who has access
to set configuration via Manage - Manage Configuration - Configuration Report page.

Fixes #22266


Vulnerable code:
	echo config_get('window_title');

Fixed code:
	echo string_display_line( config_get('window_title') );
CVE-2017-7897 (PHP, published 2017-04-18T17:59Z)
Description: value: A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/timeline_inc.php
Commit message: Fix XSS in timeline_inc.php

Use of $_SERVER['PHP_SELF'] and outputting it as-is allows an attacker
to inject arbitrary JavaScript as part of the URL.

Using SCRIPT_NAME and passing it through string_sanitize_url() instead
prevents the attack.

Fixes #22742
Fixes https://github.com/mantisbt/mantisbt/pull/1094


Vulnerable code:
$t_url_page = $_SERVER["PHP_SELF"];

Fixed code:
$t_url_page = string_sanitize_url( basename( $_SERVER['SCRIPT_NAME'] ) );
CVE-2018-13055 (PHP, published 2018-08-03T18:29Z)
Description: value: A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/filter_form_api.php
Commit message: Fix XSS in filter_form_draw_inputs() (CVE-2018-13055)

Ömer Çıtak, Security Researcher at Netsparker, reported this
vulnerability, allowing remote attackers to inject arbitrary code
(if CSP settings permit it) through a crafted PATH_INFO on
view_filters_page.php.

Prevent the attack by sanitizing the output of $_SERVER['PHP_SELF']
before display.

Fixes #24580


Vulnerable code:

Fixed code:
		$p_static_fallback_page = string_sanitize_url( $_SERVER['PHP_SELF'] );
CVE-2018-14504 (PHP, published 2018-08-03T18:29Z)
Description: value: An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
manage_filter_edit_page.php
Commit message: Fix XSS on filter edit page (CVE-2018-14504)

Teun Beijers reported a cross-site scripting (XSS) vulnerability in
the Edit Filter page which allows execution of arbitrary code
(if CSP settings permit it) when displaying a filter with a crafted
name.

Prevent the attack by sanitizing the filter name before display.

Fixes #24608


Vulnerable code:
								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo filter_get_field( $f_filter_id, 'name' ) ?>">

Fixed code:
								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo string_display_line( filter_get_field( $f_filter_id, 'name' ) ) ?>">
CVE-2018-6526 (PHP, published 2018-02-02T09:29Z)
Description: value: view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/current_user_api.php
Commit message: Fix PHP error - wrong argument type

Initialize $t_filter variable as array() instead of '' in
current_user_get_bug_filter(), to ensure its type is correct when
calling filter_ensure_valid_filter().

Fixes #23921


Vulnerable code:
	$t_filter = '';

Fixed code:
	$t_filter = array();
CVE-2018-9839 (PHP, published 2019-06-06T19:29Z)
Description: value: An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
bug_report.php
bug_report_page.php
Commit message: Prevent cloning private issues by unauthorized users

Using a crafted request on bug_report_page.php (modifying the 'm_id'
parameter), any user with REPORTER access or above is able to view any
private issue's details (summary, description, steps to reproduce,
additional information) when cloning. By checking the 'Copy issue notes'
and 'Copy attachments' checkboxes and completing the clone operation,
this data also becomes public (except private notes).

Credits to Mustafa Hasan (strukt) strukt93@gmail.com for the finding.

@atrol noted that the same vulnerability also existed in bug_report.php,
although in this case the information disclosure is limited to notes and
attachments (issue data itself does not become accessible).

Added an access level check, so that the operation now fails with an
Access Denied error in both cases.

Fixes #24221, CVE-2018-9839
Prevent cloning private issues by unauthorized users

Using a crafted request on bug_report_page.php (modifying the 'm_id'
parameter), any user with REPORTER access or above is able to view any
private issue's details (summary, description, steps to reproduce,
additional information) when cloning. By checking the 'Copy issue notes'
and 'Copy attachments' checkboxes and completing the clone operation,
this data also becomes public (except private notes).

Added an access level check, so that the operation now fails with an
Access Denied error.

Credits to Mustafa Hasan (strukt) strukt93@gmail.com for the finding.

Fixes #24221


Vulnerable code:

Fixed code:

	# User can view the master bug
	access_ensure_bug_level( config_get( 'view_bug_threshold' ), $f_master_bug_id );

	# User can view the master bug
	access_ensure_bug_level( config_get( 'view_bug_threshold' ), $f_master_bug_id );
CVE-2019-15074 (PHP, published 2019-08-21T19:15Z)
Description: value: The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/classes/IssueAttachmentTimelineEvent.class.php
Commit message: Fix XSS on timeline (CVE-2019-15074)

Kamran Saifullah reported a stored cross-site scripting (XSS)
vulnerability in Timeline, allowing execution of arbitrary code (if CSP
settings permit it) after uploading an attachment with a crafted
filename. The code is executed for any user having visibility to the
issue, whenever My View Page is displayed.

Prevent the attack by sanitizing the filename before display.

Fixes #25995


Vulnerable code:
				$this->filename

Fixed code:
				string_html_specialchars( $this->filename )
CVE-2019-15539 (PHP, published 2020-03-19T19:15Z)
Description: value: The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
proj_doc_edit_page.php
Commit message: Fix XSS on project documentation

Vulnerability in deprecated project documentation functionality
($g_enable_project_documentation), allowing execution of arbitrary
code (if CSP settings permit it) after uploading an attachment with a
crafted filename.

Prevent the attack by sanitizing the filename before display.

Fixes #26078


Vulnerable code:
			echo '</a>&#160;' . $t_href . file_get_display_name( $v_filename ) . '</a>';

Fixed code:
			echo '</a>&#160;' . $t_href . string_html_specialchars( file_get_display_name( $v_filename ) ) . '</a>';
CVE-2019-15715 (PHP, published 2019-10-09T20:15Z)
Description: value: MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
config_defaults_inc.php
Commit message: Prevent arbitrary shell command execution

Prior to this, Administrators were able to edit 'dot_tool' and
'neato_tool' config options from the Manage Configuration Page

These can now only be set in the config_inc.php file.

Fixes #26091, CVE-2019-15715

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Original commit message reworded, added CVE reference.


Vulnerable code:
	'impersonate_user_threshold', 'email_retry_in_days'

Fixed code:
	'impersonate_user_threshold', 'email_retry_in_days', 'neato_tool', 'dot_tool'
CVE-2019-15715 (PHP, published 2019-10-09T20:15Z)
Description: value: MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/graphviz_api.php
Commit message: Escape GraphViz command before calling proc_open()

Fixes #26091, CVE-2019-15715


Vulnerable code:
		$t_command = $this->graphviz_tool . ' -T' . $p_format;

Fixed code:
		$t_command = escapeshellcmd( $this->graphviz_tool . ' -T' . $p_format );
CVE-2020-25288 (PHP, published 2020-09-30T21:15Z)
Description: value: An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/cfdefs/cfdef_standard.php
Commit message: Fix XSS in Custom Field regex pattern validation

Improper escaping of the custom field definition's Regular Expression
allowed an attacker to inject HTML into the page (CVE-2020-25288).

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for the finding.

Fixes #27275


Vulnerable code:
		echo ' pattern="' . $t_cf_regex . '"';

Fixed code:
		echo ' pattern="' . string_attribute( $t_cf_regex ) . '"';
CVE-2020-25781 (PHP, published 2020-09-30T21:15Z)
Description: value: An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/file_api.php
Commit message: Functions to check view/download ability at bugnote level

2 new File API functions:
- file_can_view_bugnote_attachments()
- file_can_download_bugnote_attachments

Prerequisite to fix issue #27039


Vulnerable code:
function file_can_view_or_download( $p_action, $p_bug_id, $p_uploader_user_id ) {
	$t_can_access = access_has_bug_level( $t_access_global, $p_bug_id );

Fixed code:
 * @param int|null $p_bugnote_id        If specified, will check at bugnote level
function file_can_view_or_download( $p_action, $p_bug_id, $p_uploader_user_id, $p_bugnote_id = null ) {
	if( $p_bugnote_id === null ) {
		$t_can_access = access_has_bug_level( $t_access_global, $p_bug_id );
	} else {
		$t_can_access = access_has_bugnote_level( $t_access_global, $p_bugnote_id );
	}
/**
 * Check if the current user can view attachments for the specified bug note.
 *
 * @param integer $p_bugnote_id       A bugnote identifier.
 * @param integer $p_uploader_user_id The user who uploaded the attachment.
 *
 * @return boolean
 */
function file_can_view_bugnote_attachments( $p_bugnote_id, $p_uploader_user_id = null ) {
	if( $p_bugnote_id == 0 ) {
		return true;
	}
	$t_bug_id = bugnote_get_field( $p_bugnote_id, 'bug_id' );
	return file_can_view_or_download( 'view', $t_bug_id, $p_uploader_user_id );
}

/**
 * Check if the current user can download attachments for the specified bug note.
 *
 * @param integer $p_bugnote_id       A bugnote identifier.
 * @param integer $p_uploader_user_id The user who uploaded the attachment.
 *
 * @return boolean
 */
function file_can_download_bugnote_attachments( $p_bugnote_id, $p_uploader_user_id = null ) {
	if( $p_bugnote_id == 0 ) {
		return true;
	}
	$t_bug_id = bugnote_get_field( $p_bugnote_id, 'bug_id' );
	return file_can_view_or_download( 'download', $t_bug_id, $p_uploader_user_id, $p_bugnote_id );
}
CVE-2020-25781 (PHP, published 2020-09-30T21:15Z)
Description: value: An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/file_api.php
file_download.php
Commit message: Check ability to download attachments at bugnote level

This prevents users authorized to download attachments but not to view
private bugnotes, from accessing files attached to a private note via
`file_download.php?file_id={FILE_ID}&type=bug` (CVE-2020-25781).

Includes some minor code cleanup in file_get_visible_attachments():
- use a foreach loop
- reuse variables instead of derefenrcing array

Fixes #27039


Vulnerable code:
	$t_attachments_view_threshold = config_get( 'view_attachments_threshold' );
	for( $i = 0;$i < $t_attachments_count;$i++ ) {
		$t_row = $t_attachment_rows[$i];
		# This covers access checks for issue attachments
		if( !file_can_view_bug_attachments( $p_bug_id, $t_user_id ) ) {
		# This covers access checks for issue note attachments
		$t_attachment_note_id = (int)$t_row['bugnote_id'];
		if( $t_attachment_note_id !== 0 ) {
			if( bugnote_get_field( $t_attachment_note_id, 'view_state' ) != VS_PUBLIC ) {
				if( !access_has_bugnote_level( $t_attachments_view_threshold, $t_attachment_note_id ) ) {
					continue;
				}
			}
		}

		$t_filesize = $t_row['filesize'];
		$t_attachment['size'] = (int)$t_filesize;
		$t_attachment['bugnote_id'] = (int)$t_row['bugnote_id'];
		$t_attachment['can_download'] = file_can_download_bug_attachments( $p_bug_id, (int)$t_row['user_id'] );
		$t_attachment['can_delete'] = file_can_delete_bug_attachments( $p_bug_id, (int)$t_row['user_id'] );
		if( !file_can_download_bug_attachments( $v_bug_id, (int)$v_user_id ) ) {

Fixed code:
	foreach( $t_attachment_rows as $t_row ) {
		$t_attachment_note_id = (int)$t_row['bugnote_id'];
		if( !file_can_view_bug_attachments( $p_bug_id, $t_user_id )
		|| !file_can_view_bugnote_attachments( $t_attachment_note_id, $t_user_id )
		) {
		$t_filesize = (int)$t_row['filesize'];
		$t_attachment['size'] = $t_filesize;
		$t_attachment['bugnote_id'] = $t_attachment_note_id;
		$t_attachment['can_download'] = file_can_download_bug_attachments( $p_bug_id, $t_user_id );
		$t_attachment['can_delete'] = file_can_delete_bug_attachments( $p_bug_id, $t_user_id );
		if( !file_can_download_bug_attachments( $v_bug_id, $v_user_id )
		|| !file_can_download_bugnote_attachments( $v_bugnote_id, $v_user_id )
		) {
CVE-2020-25830 (PHP, published 2020-09-30T21:15Z)
Description: value: An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
bug_actiongroup_page.php
Commit message: Fix XSS in bug_actiongroup_page.php

Improper escaping of the custom field's name allowed an attacker to
inject HTML into the page.

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for the finding.

Fixes #27304


Vulnerable code:
		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ), lang_get_defaulted( $t_custom_field_def['name'] ) );

Fixed code:
		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ),
			string_attribute( lang_get_defaulted( $t_custom_field_def['name'] ) )
		);
CVE-2021-43257 (PHP, published 2022-04-14T20:15Z)
Description: value: Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/csv_api.php
Commit message: Escape strings to prevent CSV injection

Prefixing the string with a tab when it starts with =, -, + or @.

Thanks to Devendra Bhatla for reporting the issue.

Fixes #29130, CVE-2021-43257


Vulnerable code:

Fixed code:
	# Prevent CSV injection by escaping text that could be interpreted as a formula
	if( $p_string && strpos( '=-+@', $p_string[0] ) !== false ) {
		# Prefixing with a tab rather than single quote, as Excel does not show
		# the tab visually in the cell.
		$p_string = "\t" . $p_string;
	}