CVE-2017-7309
published 2017-03-31CVE-2017-7309: A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code…
PriorityP434medium4.8CVSS 3.0
AVNACLPRHUIRSCCLILAN
EPSS
57.70%
99.0th percentile
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | — | — |
| mantisbt | mantisbt | >= 0 < 1.3.9 | 1.3.9 |
| mantisbt | mantisbt | >= 2.1.0 < 2.1.3 | 2.1.3 |
| mantisbt | mantisbt | >= 2.2.0 < 2.2.3 | 2.2.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP requests to adm_config_report.php for suspicious or script-injecting values in the 'config_option' parameter ↗
- →Exploitation is conditional on CSP settings permitting inline script execution; review CSP headers on MantisBT instances to assess exploitability ↗
- ·Vulnerability only exploitable if Content Security Policy (CSP) settings permit inline script execution ↗
- ·Fixed in MantisBT versions 1.3.9, 2.1.3, and 2.2.3; instances running earlier versions remain vulnerable ↗
CVSS provenance
nvdv3.04.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
osv·2022-05-17
CVE-2017-7309 [MEDIUM] MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
GHSA
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
ghsa·2022-05-17
CVE-2017-7309 [MEDIUM] CWE-79 MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3
bugzilla·2017-03-31·CVSS 4.8
CVE-2017-6973 [MEDIUM] CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3
CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3
Three cross-site scripting issues were reported in MantisBT:
CVE-2017-6973:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
CVE-2017-7241:
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exp
Bugzilla
CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3 [epel-5]
bugzilla·2017-03-31·CVSS 4.8
CVE-2017-6973 [MEDIUM] CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3 [epel-5]
CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3 [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-5.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Bugzilla
CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3 [fedora-all]
bugzilla·2017-03-31·CVSS 4.8
CVE-2017-6973 [MEDIUM] CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3 [fedora-all]
CVE-2017-6973 CVE-2017-7241 CVE-2017-7309 mantis: three cross-site scripting issues fixed in 1.3.9, 2.1.3, 2.2.3 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE
http://openwall.com/lists/oss-security/2017/03/30/4http://www.mantisbt.org/bugs/view.php?id=22579http://www.securityfocus.com/bid/97251http://www.securitytracker.com/id/1038169http://openwall.com/lists/oss-security/2017/03/30/4http://www.mantisbt.org/bugs/view.php?id=22579http://www.securityfocus.com/bid/97251http://www.securitytracker.com/id/1038169
2017-03-31
Published