PT-2017-1616 · Mantisbt · Mantisbt

Vboctor · Publicado 2017-03-22 · Atualizado 2017-03-23 · CVE-2017-7222

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.1.1

Description A cross-site scripting (XSS) issue exists due to insufficient protection of the web page structure. This allows a remote attacker to inject arbitrary HTML or JavaScript code by modifying the window title in the application configuration, which requires administrator access rights or alteration of the system configuration file (config inc.php).

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the MantisBT configuration management pages to prevent unauthorized modifications to the window title setting.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2017-00769

CVE-2017-7222

Produtos afetados

Mantisbt

Referências · 6

• https://mantisbt.org/bugs/view.php?id=22266 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7222 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7222 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7222 · Nota
• http://github.com/mantisbt/mantisbt/commit/a85b0b96c8ebe3e010d0d016cf88ab3c8bfc196a · Correção
• https://bdu.fstec.ru/vul/2017-00769 · Nota de Segurança