CVE-2017-6973: MantisBT Cross-Site Scripting Vulnerability in Configuration Report
Summary
CVE-2017-6973: MantisBT XSS via adm_config_report.php's action parameter. Affects mantisbt/mantisbt across 3 version ranges.
< 1.3.8
>= 2.0.0, < 2.1.2
>= 2.2.0, < 2.2.2
Fixed in 1.3.8, 2.1.2 or 2.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that provides a robust platform for managing software development projects. It allows users to track bugs, manage projects, and collaborate effectively. However, like many web applications, MantisBT can be susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks. This specific vulnerability affects the Configuration Report page, where improper handling of user input can lead to malicious code execution.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability exists in the MantisBT Configuration Report page (adm_config_report.php). This flaw allows remote attackers to inject arbitrary JavaScript code through a crafted 'action' parameter. If exploited, this vulnerability can lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The vulnerability has been classified under CWE-79, indicating improper input validation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.81.3.8composer require mantisbt/mantisbt:1.3.8 -
>= 2.0.0, < 2.1.22.1.2composer require mantisbt/mantisbt:2.1.2 -
>= 2.2.0, < 2.2.22.2.2composer require mantisbt/mantisbt:2.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation and sanitization for the 'action' parameter in the adm_config_report.php file. This can help mitigate the risk of XSS attacks until the software can be updated.
Conclusion
The XSS vulnerability in MantisBT's Configuration Report page poses a significant risk to users and their data. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into the application.
If you are using MantisBT versions prior to 1.3.8, 2.1.2, or 2.2.2, your installation is vulnerable. You can also use Vulert to check if your application is affected.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and session hijacking, compromising user accounts and sensitive information.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your composer.lock file.
The CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
