From 85752af83442cf97bec660825f73c49f9f750dfc Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 30 May 2025 14:37:54 +0000
Subject: [PATCH] Publish Advisories

GHSA-gcqw-45xq-xc63
GHSA-ggjm-7m5f-7xjv
---
 .../GHSA-gcqw-45xq-xc63.json                  | 37 +++++++++++++++++--
 .../GHSA-ggjm-7m5f-7xjv.json                  | 37 +++++++++++++++++--
 2 files changed, 66 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json (56%)
 rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json (56%)

diff --git a/advisories/unreviewed/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json b/advisories/github-reviewed/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json
similarity index 56%
rename from advisories/unreviewed/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json
rename to advisories/github-reviewed/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json
index f36c4789d5d..99f880bbdca 100644
--- a/advisories/unreviewed/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json
+++ b/advisories/github-reviewed/2022/05/GHSA-gcqw-45xq-xc63/GHSA-gcqw-45xq-xc63.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gcqw-45xq-xc63",
-  "modified": "2022-05-14T01:52:00Z",
+  "modified": "2025-05-30T14:36:34Z",
   "published": "2022-05-14T01:52:00Z",
   "aliases": [
     "CVE-2018-17783"
   ],
+  "summary": "MantisBT allows XSS via Edit Filter page ",
   "details": "A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.",
   "severity": [
     {
@@ -13,12 +14,40 @@
       "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "mantisbt/mantisbt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.1.0"
+            },
+            {
+              "fixed": "2.17.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17783"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mantisbt/mantisbt/commit/b9453cd7643b7c5b1b8c716b1dbd4d7d9571d1ec"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mantisbt/mantisbt"
+    },
     {
       "type": "WEB",
       "url": "https://mantisbt.org/blog/archives/mantisbt/613"
@@ -33,8 +62,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-30T14:36:34Z",
     "nvd_published_at": "2018-10-30T18:29:00Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json b/advisories/github-reviewed/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json
similarity index 56%
rename from advisories/unreviewed/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json
rename to advisories/github-reviewed/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json
index 513b53f972d..b7be3a517d9 100644
--- a/advisories/unreviewed/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json
+++ b/advisories/github-reviewed/2022/05/GHSA-ggjm-7m5f-7xjv/GHSA-ggjm-7m5f-7xjv.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ggjm-7m5f-7xjv",
-  "modified": "2022-05-14T01:52:00Z",
+  "modified": "2025-05-30T14:37:21Z",
   "published": "2022-05-14T01:52:00Z",
   "aliases": [
     "CVE-2018-17782"
   ],
+  "summary": "MantisBT allows XSS via the Manage Filter page ",
   "details": "A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.",
   "severity": [
     {
@@ -13,12 +14,40 @@
       "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "mantisbt/mantisbt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.1.0"
+            },
+            {
+              "fixed": "2.17.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17782"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mantisbt/mantisbt/commit/72ab020a42a35fd341e983a25849f8277bb34044"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mantisbt/mantisbt"
+    },
     {
       "type": "WEB",
       "url": "https://mantisbt.org/blog/archives/mantisbt/613"
@@ -33,8 +62,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-30T14:37:21Z",
     "nvd_published_at": "2018-10-30T18:29:00Z"
   }
 }
\ No newline at end of file