GitHub Advisoryadvisory · Packagist

GHSA-9x76-mp7r-2xc5 MantisBT vulnerable to CSRF and Open Redirect attacks

MEDIUM Published 2022-05-17 Modified 2025-04-22 Official page ↗
Aliases
CVE-2017-7620
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2025-04-22

Affected packages

• Packagist mantisbt/mantisbt: < 1.3.11 → fixed in 1.3.11 • Packagist mantisbt/mantisbt: >= 2.0.0, < 2.3.3 → fixed in 2.3.3 • Packagist mantisbt/mantisbt: >= 2.4.0, < 2.4.1 → fixed in 2.4.1

Description

MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.

Related

Alias · CVE (1)

  • CVE-2017-7620 MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References