CVE-2024-34081: 
PHP vulnerability analysis and mitigation

MantisBT (Mantis Bug Tracker), an open source issue tracker, was found to contain a cross-site scripting (XSS) vulnerability identified as CVE-2024-34081. The vulnerability stems from improper escaping of custom field names, which was discovered on May 4, 2024, and patched in version 2.26.2 (MantisBT Advisory).

The vulnerability is caused by insufficient sanitization of custom field names in multiple pages of the application. When a custom field with HTML content in its name is created, the application fails to properly escape this content when displaying it in various contexts. The vulnerability has been assigned a CVSS v3.1 base score of 6.6 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L, indicating network accessibility with low attack complexity but requiring high privileges (NVD).

The vulnerability allows an attacker to inject HTML and, if Content Security Policy (CSP) settings permit, achieve execution of arbitrary JavaScript in multiple contexts: when resolving or closing issues, viewing issues when the custom field is displayed as a column, and printing issues when the custom field is displayed as a column (MantisBT Advisory).

The vulnerability can be exploited through three main vectors: bug_change_status_page.php when resolving or closing issues belonging to a project linking the affected custom field, view_all_bug_page.php when the custom field is displayed as a column, and print_all_bug_page.php when the custom field is displayed as a column (MantisBT Issue).

The vulnerability has been patched in MantisBT version 2.26.2. As a temporary workaround, administrators can ensure that Custom Field Names do not contain HTML tags. The fix involves proper escaping of custom field names before display, implemented through a patch that modifies the string handling in the affected files (MantisBT Patch).