MantisBT multiple security issues - Vulnerability Database

MantisBT multiple security issues

Description

MantisBT versions 1.2.18 and earlier contain multiple critical security vulnerabilities that allow unauthorized access and malicious attacks. These issues include cross-site scripting (XSS) vulnerabilities, improper access controls during installation, SQL injection flaws, CAPTCHA bypass mechanisms, and URL redirection weaknesses. The vulnerabilities affect core functionality including the installation process, user management interface, and authentication mechanisms. Organizations running any version in the 1.2.x series prior to 1.2.19 are at significant risk and should prioritize remediation.

Remediation

Immediately upgrade to MantisBT version 1.2.19 or later to remediate all identified vulnerabilities. Follow these steps:

Backup your installation: Create complete backups of your MantisBT database and file system before proceeding
Download the latest version: Obtain MantisBT 1.2.19 or newer from the official MantisBT website
Review the upgrade guide: Consult the official MantisBT upgrade documentation for version-specific instructions
Perform the upgrade: Follow the standard upgrade procedure, ensuring all files are properly replaced and database migrations are executed
Secure the installation directory: After upgrade, ensure that install.php and the admin directory are removed or protected from public access
Verify the installation: Confirm the upgrade was successful by checking the version number in the MantisBT interface
Review access logs: Examine server logs for any suspicious activity that may indicate prior exploitation
Reset credentials if compromised: If you suspect the installation was previously compromised, reset all user passwords and database credentials

For installations where immediate upgrade is not possible, implement temporary mitigations:

Remove or restrict access to install.php and admin/install.php at the web server level
Implement web application firewall (WAF) rules to filter malicious input
Restrict access to the MantisBT installation using IP whitelisting where feasible