MantisBT XSS via move_attachments_page.php

Also known as GHSA-x53v-v9xp-gf6g

Published 9 y ago 2017-03-31 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.9%

percentile 61%

Public exploits

none known

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Exploit prediction (EPSS)

0.93% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	4.8	`CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:N/I:P/A:N`
GitHub	3.0	4.8	`CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`mantisbt/mantisbt`	<1.3.9 >=2.0.0, <2.1.3 >=2.2.0, <2.2.3	1.3.9 2.1.3 2.2.3

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

openwall.com /lists/oss-security/2017/03/30/4 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1038169 · vdb-entry, x_refsource_SECTRACK, x_transferred
mantisbt.org /bugs/view.php?id=22568 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/97253 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-7241 · advisory
github.com /mantisbt/mantisbt/commit/2d55c6476e939db021128b3995c28dcae05b09a4 · web
github.com /mantisbt/mantisbt/commit/d31841c806a3c8379fcf6c9d9559451270b0f1cb · web
github.com /mantisbt/mantisbt/commit/ecef0e9b523a460709e8feedfce72f05bb30b992 · web
github.com /mantisbt/mantisbt · package

Sources

CVE List: CVE-2017-7241
GitHub Advisory: GHSA-x53v-v9xp-gf6g
NVD: CVE-2017-7241

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.