PT-2017-1616 · Mantisbt · Mantisbt

Vboctor · Published 2017-03-22 · Updated 2017-03-23 · CVE-2017-7222

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.1.1

Description A cross-site scripting (XSS) issue exists due to insufficient protection of the web page structure. This allows a remote attacker to inject arbitrary HTML or JavaScript code by modifying the window title in the application configuration, which requires administrator access rights or alteration of the system configuration file (config inc.php).

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the MantisBT configuration management pages to prevent unauthorized modifications to the window title setting.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2017-00769

CVE-2017-7222

Affected Products

Mantisbt

References · 6

• https://mantisbt.org/bugs/view.php?id=22266 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7222 · Security Note
• http://github.com/mantisbt/mantisbt/commit/a85b0b96c8ebe3e010d0d016cf88ab3c8bfc196a · Patch
• https://bdu.fstec.ru/vul/2017-00769 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7222 · Note