CVE-2017-7897: XSS
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (myviewpage.php) and User Information (viewuserpage.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATHINFO in a URL, due to use of unsanitized $SERVER['PHPSELF'] to generate URLs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7897?
CVE-2017-7897 is categorized as a cross-site scripting (XSS) vulnerability which can allow attackers to inject arbitrary code.
How do I fix CVE-2017-7897?
To resolve CVE-2017-7897, upgrade MantisBT to version 2.3.2 or later where this vulnerability has been patched.
Which versions of MantisBT are affected by CVE-2017-7897?
CVE-2017-7897 affects MantisBT versions 2.3.0 and 2.3.1.
What kind of attacks can CVE-2017-7897 facilitate?
CVE-2017-7897 can facilitate cross-site scripting attacks, which can lead to the execution of arbitrary scripts in the context of a user's browser.
Where can I find more information about CVE-2017-7897?
Details about CVE-2017-7897 can be found in various security advisories and repositories that document the issue.