CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-7241

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.007

EPSS Ranking 71.2%

CVSS Severity

CVSS v3 Score 4.8

CVSS v2 Score 3.5

References

Products affected by CVE-2017-7241

Mantisbt » Mantisbt » Version: 1.2.16

cpe:2.3:a:mantisbt:mantisbt:1.2.16
Mantisbt » Mantisbt » Version: 1.2.17

cpe:2.3:a:mantisbt:mantisbt:1.2.17
Mantisbt » Mantisbt » Version: 1.2.18

cpe:2.3:a:mantisbt:mantisbt:1.2.18
Mantisbt » Mantisbt » Version: 1.2.19

cpe:2.3:a:mantisbt:mantisbt:1.2.19
Mantisbt » Mantisbt » Version: 1.2.20

cpe:2.3:a:mantisbt:mantisbt:1.2.20
Mantisbt » Mantisbt » Version: 1.3.0

cpe:2.3:a:mantisbt:mantisbt:1.3.0
Mantisbt » Mantisbt » Version: 1.3.1

cpe:2.3:a:mantisbt:mantisbt:1.3.1
Mantisbt » Mantisbt » Version: 1.3.2

cpe:2.3:a:mantisbt:mantisbt:1.3.2
Mantisbt » Mantisbt » Version: 1.3.3

cpe:2.3:a:mantisbt:mantisbt:1.3.3
Mantisbt » Mantisbt » Version: 1.3.4

cpe:2.3:a:mantisbt:mantisbt:1.3.4
Mantisbt » Mantisbt » Version: 1.3.5

cpe:2.3:a:mantisbt:mantisbt:1.3.5
Mantisbt » Mantisbt » Version: 1.3.6

cpe:2.3:a:mantisbt:mantisbt:1.3.6
Mantisbt » Mantisbt » Version: 1.3.7

cpe:2.3:a:mantisbt:mantisbt:1.3.7
Mantisbt » Mantisbt » Version: 1.3.8

cpe:2.3:a:mantisbt:mantisbt:1.3.8
Mantisbt » Mantisbt » Version: 1.3.9

cpe:2.3:a:mantisbt:mantisbt:1.3.9
Mantisbt » Mantisbt » Version: 2.0.0

cpe:2.3:a:mantisbt:mantisbt:2.0.0
Mantisbt » Mantisbt » Version: 2.0.1

cpe:2.3:a:mantisbt:mantisbt:2.0.1
Mantisbt » Mantisbt » Version: 2.1.0

cpe:2.3:a:mantisbt:mantisbt:2.1.0
Mantisbt » Mantisbt » Version: 2.1.1

cpe:2.3:a:mantisbt:mantisbt:2.1.1
Mantisbt » Mantisbt » Version: 2.1.2

cpe:2.3:a:mantisbt:mantisbt:2.1.2
Mantisbt » Mantisbt » Version: 2.1.3

cpe:2.3:a:mantisbt:mantisbt:2.1.3
Mantisbt » Mantisbt » Version: 2.2.0

cpe:2.3:a:mantisbt:mantisbt:2.2.0
Mantisbt » Mantisbt » Version: 2.2.1

cpe:2.3:a:mantisbt:mantisbt:2.2.1
Mantisbt » Mantisbt » Version: 2.2.2

cpe:2.3:a:mantisbt:mantisbt:2.2.2
Mantisbt » Mantisbt » Version: 2.2.3

cpe:2.3:a:mantisbt:mantisbt:2.2.3
Mantisbt » Mantisbt » Version: 2.3.0

cpe:2.3:a:mantisbt:mantisbt:2.3.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-7241

Products

Pricing

Contact Us