CVE-2017-7309: XSS
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (admconfigreport.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.2.3 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.1.3 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 1.3.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.3.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.3
Event History
Frequently Asked Questions
What is CVE-2017-7309?
CVE-2017-7309 is a cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page that allows remote attackers to inject arbitrary code via a crafted 'config_option' parameter.
How do I fix CVE-2017-7309?
To fix CVE-2017-7309, you should upgrade to MantisBT versions 1.3.9, 2.1.3, or 2.2.3 or later.
What versions of MantisBT are affected by CVE-2017-7309?
CVE-2017-7309 affects MantisBT versions 1.3.0-rc2 through 1.3.8, and all versions below 2.1.3.
What are the potential risks of CVE-2017-7309?
Exploitation of CVE-2017-7309 could lead to unauthorized access or control over user sessions, potentially compromising sensitive information.
Is CVE-2017-7309 a serious vulnerability?
Yes, CVE-2017-7309 is considered serious due to its potential for XSS attacks which can be exploited if CSP settings permit.