CVE-2017-7222: XSS
A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (configinc.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MantisBTto a version that resolves this vulnerability.Fixed in 2.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7222?
CVE-2017-7222 is classified as a medium severity cross-site scripting (XSS) vulnerability that affects MantisBT before version 2.1.1.
How do I fix CVE-2017-7222?
To fix CVE-2017-7222, upgrade MantisBT to version 2.1.1 or later to ensure the vulnerability is patched.
What systems are affected by CVE-2017-7222?
CVE-2017-7222 affects all versions of MantisBT prior to 2.1.1, specifically targeting those with configurable 'window_title' settings.
Can CVE-2017-7222 be exploited remotely?
Yes, CVE-2017-7222 can be exploited remotely by authenticated users with privileged access to modify application configurations.
What kind of attacks can CVE-2017-7222 facilitate?
CVE-2017-7222 can facilitate cross-site scripting attacks, allowing attackers to inject arbitrary HTML or JavaScript into web pages.