CVE-2017-12062: XSS
Published Aug 1, 2017
·Updated
An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
Affected Software
19 affected componentsFixes available
MantisBT mantisbt=2.1.0
MantisBT mantisbt=2.1.1
MantisBT mantisbt=2.1.2
MantisBT mantisbt=2.1.3
MantisBT mantisbt=2.2.0
MantisBT mantisbt=2.2.1
MantisBT mantisbt=2.2.2
MantisBT mantisbt=2.2.3
MantisBT mantisbt=2.2.4
MantisBT mantisbt=2.3.0
MantisBT mantisbt=2.3.1
MantisBT mantisbt=2.3.2
MantisBT mantisbt=2.3.3
MantisBT mantisbt=2.4.0
MantisBT mantisbt=2.4.1
MantisBT mantisbt=2.4.2
MantisBT mantisbt=2.5.0
MantisBT mantisbt=2.5.1
composer/mantisbt/mantisbt>=2.0.0<2.5.2
2.5.2
Remediation
Event History
Aug 1, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·02:13 AM
Data Sourced
via GitHub·02:13 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-12062?
CVE-2017-12062 has a medium severity due to its potential for XSS attacks.
2
How do I fix CVE-2017-12062?
To fix CVE-2017-12062, upgrade MantisBT to version 2.5.2 or later.
3
What systems are affected by CVE-2017-12062?
CVE-2017-12062 affects MantisBT versions from 2.1.0 up to but not including 2.5.2.
4
What type of vulnerability is CVE-2017-12062?
CVE-2017-12062 is an XSS (Cross-Site Scripting) vulnerability.
5
Can CVE-2017-12062 lead to data theft?
Yes, CVE-2017-12062 can lead to data theft by allowing attackers to execute arbitrary JavaScript.