CVE-2017-7241: XSS
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (moveattachmentspage.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.2.3 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.1.3 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 1.3.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.3.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.3 - Remove
Remove
MantisBT admin tools directoryfrom your environment.Remove the admin tools directory (as recommended in the MantisBT Admin Guide “Post-installation and upgrade tasks”) to prevent exploitation of the XSS in the Move Attachments page (move_attachments_page.php).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7241?
CVE-2017-7241 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2017-7241?
To fix CVE-2017-7241, upgrade MantisBT to version 1.3.9 or later.
Which versions of MantisBT are affected by CVE-2017-7241?
CVE-2017-7241 affects MantisBT versions from 1.2.16 to 1.3.8 and includes several beta and release candidates.
What is the impact of exploiting CVE-2017-7241?
Exploiting CVE-2017-7241 allows remote attackers to inject arbitrary code into the Move Attachments page, potentially leading to further attacks.
Is there a workaround for CVE-2017-7241 if I cannot upgrade?
If upgrading is not possible, implementing stricter Content Security Policy (CSP) settings may mitigate some risks associated with CVE-2017-7241.