CVEvulnerability

CVE-2017-7241

4.8 MEDIUM Published 2017-03-31 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-03-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.8 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Affected configurations

• mantisbt mantisbt 1.2.16 • mantisbt mantisbt 1.2.17 • mantisbt mantisbt 1.2.18 • mantisbt mantisbt 1.2.19 • mantisbt mantisbt 1.2.20 • mantisbt mantisbt 1.3.0 • mantisbt mantisbt 1.3.1 • mantisbt mantisbt 1.3.2 • mantisbt mantisbt 1.3.3 • mantisbt mantisbt 1.3.4 • mantisbt mantisbt 1.3.5 • mantisbt mantisbt 1.3.6 • mantisbt mantisbt 1.3.7 • mantisbt mantisbt 1.3.8 • mantisbt mantisbt 1.3.9 • mantisbt mantisbt 2.0.0 • mantisbt mantisbt 2.0.1 • mantisbt mantisbt 2.1.0 • mantisbt mantisbt 2.1.1 • mantisbt mantisbt 2.1.2 • mantisbt mantisbt 2.1.3 • mantisbt mantisbt 2.2.0 • mantisbt mantisbt 2.2.1 • mantisbt mantisbt 2.2.2 • mantisbt mantisbt 2.2.3 • mantisbt mantisbt 2.3.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References