CVE-2017-7615: High severity MantisBT mantisbt vulnerability
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.2.4 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 1.3.10
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7615?
CVE-2017-7615 is classified as a high severity vulnerability due to the potential for unauthorized access and control over MantisBT.
How do I fix CVE-2017-7615?
The fix for CVE-2017-7615 involves upgrading MantisBT to a version later than 2.3.0 to mitigate the risk of this vulnerability.
What types of attacks can exploit CVE-2017-7615?
CVE-2017-7615 can be exploited to perform arbitrary password resets and gain unauthenticated admin access.
Which versions of MantisBT are affected by CVE-2017-7615?
CVE-2017-7615 affects MantisBT versions up to and including 2.3.0.
What is the cause of CVE-2017-7615?
CVE-2017-7615 is caused by an empty confirm_hash value in the verify.php script, allowing unauthorized actions.