CVE-2017-7620: CSRF
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in stringapi.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalinkpage.php?url= URI and (2) an open redirect via a loginpage.php?return= URI.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7620?
CVE-2017-7620 is considered a medium severity vulnerability.
How do I fix CVE-2017-7620?
To fix CVE-2017-7620, upgrade MantisBT to version 1.3.11 or 2.3.3 and later.
What versions of MantisBT are affected by CVE-2017-7620?
CVE-2017-7620 affects MantisBT versions before 1.3.11 and 2.x versions before 2.3.3 and 2.4.x before 2.4.1.
What type of attack does CVE-2017-7620 allow?
CVE-2017-7620 allows for arbitrary permalink injection via a cross-site request forgery (CSRF) attack.
Is there a workaround for CVE-2017-7620 if I cannot upgrade MantisBT?
There are no recommended workarounds for CVE-2017-7620; upgrading is the only effective solution.