CVE-2023-49802

MantisBT LinkedCustomFields Cross-site Scripting vulnerability

6.7 Medium

The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.66%Up 0.6 points since Dec 12, 2023

What each source reports

CVE List Score used 6.7

MantisBT LinkedCustomFields Cross-site Scripting vulnerability

Record: CVE-2023-49802
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-53714 6.7

Record: EUVD-2023-53714
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-03

NVD 6.7

Record: CVE-2023-49802
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.7

MantisBT LinkedCustomFields Cross-site Scripting vulnerability

Record: CVE-2023-49802
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-79
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-49802 is a medium vulnerability (CVSS 6.7) in Mantisbt-plugins Linkedcustomfields, published December 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. No source names a fixed version.