GitHub Advisoryadvisory · Packagist

GHSA-v7qf-22rw-chph MantisBT XSS via adm_config_report.php's action parameter

MEDIUM Published 2022-05-17 Modified 2025-06-11 Official page ↗
Aliases
CVE-2017-6973
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-06-11

Affected packages

• Packagist mantisbt/mantisbt: < 1.3.8 → fixed in 1.3.8 • Packagist mantisbt/mantisbt: >= 2.0.0, < 2.1.2 → fixed in 2.1.2 • Packagist mantisbt/mantisbt: >= 2.2.0, < 2.2.2 → fixed in 2.2.2

Description

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

Related

Alias · CVE (1)

  • CVE-2017-6973 A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References