Security readout for executives and security teams
Plain-English summary
MantisBT versions before 2.25.2 had a cross-site scripting flaw in the custom field edit page. A crafted return parameter could place attacker-controlled script content into a hidden form field. This can matter where administrators or privileged users manage custom fields, but the provided sources do not state severity or active exploitation.
Executive priority
Treat this as a moderate web application risk. Upgrade affected MantisBT systems, especially exposed or business-critical instances, but there is no source-backed evidence here of active exploitation or a critical severity rating.
Technical view
CVE-2021-33557 is an XSS issue in manage_custom_field_edit_page.php. The return parameter was output without escaping, allowing injection into a hidden input field. The affected range is described as MantisBT before 2.25.2. No CVSS score, CWE mapping, or exploit telemetry is provided in the source bundle.
Likely exposure
Exposure is limited to MantisBT deployments before 2.25.2. The sources do not define authentication requirements, internet exposure, or reachable user roles, so teams should validate version and access to the custom field management page.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not claim active exploitation. The issue is still relevant because XSS can affect users who interact with vulnerable pages, especially privileged application users.
Researcher notes
The key technical fact is unescaped output of the return parameter into a hidden input field. Evidence is incomplete on privilege requirements, exploit availability, and impact beyond XSS. Avoid assuming affected products beyond MantisBT before 2.25.2.
Mitigation direction
- Upgrade MantisBT to version 2.25.2 or later.
- Review the MantisBT issue and release notes for vendor guidance.
- Restrict access to administrative custom field pages where possible.
- Monitor application logs for suspicious return parameter activity.
- Prioritize remediation on internet-facing or externally accessible MantisBT instances.
Validation and detection
- Inventory all MantisBT deployments and confirm their running version.
- Verify vulnerable systems are upgraded to 2.25.2 or later.
- Confirm manage_custom_field_edit_page.php no longer outputs return unescaped.
- Review recent requests involving the return parameter for anomalies.
- Document whether the page is externally reachable and who can access it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-33557 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://mantisbt.org/bugs/view.php?id=28552CVE reference · x_refsource_MISC
- https://mantisbt.org/blog/archives/mantisbt/699CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.