6.5med
CVE-2017-76201 exploit
MantisBT vulnerable to CSRF and Open Redirect attacks
Also known as GHSA-9x76-mp7r-2xc5
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
1
Exploit-DB
Summary
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Exploit prediction (EPSS)
1.36% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.
Exploits and detections
- EDB-42043 Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery · webapps · 2017-05-20
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | mantisbt/mantisbt | <1.3.11 >=2.0.0, <2.3.3 >=2.4.0, <2.4.1 | 1.3.11 2.3.3 2.4.1 |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- mantisbt.org /bugs/view.php?id=22816 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1038538 · vdb-entry, x_refsource_SECTRACK, x_transferred
- exploit-db.com /exploits/42043/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- mantisbt.org /bugs/view.php?id=22702 · x_refsource_CONFIRM, x_transferred
- hyp3rlinx.altervista.org /advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7620 · advisory
- github.com /mantisbt/mantisbt/commit/2d2309a384bcd9d4b6d7d2928e8ded2c46d2d7b0 · web
- github.com /mantisbt/mantisbt/commit/8b6787c8d321ee0ced5fb74ac3f34b67b4b7b26c · web
- github.com /mantisbt/mantisbt/commit/c4f50e5df6b189abb1d717a5f7dbab5cbfef8165 · web
- github.com /mantisbt/mantisbt · package
- exploit-db.com /exploits/42043 · web
Sources
- CVE List: CVE-2017-7620
- GitHub Advisory: GHSA-9x76-mp7r-2xc5
- NVD: CVE-2017-7620
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.