CVE-2017-7241: MantisBT XSS Vulnerability in Move Attachments Page
Summary
CVE-2017-7241: MantisBT XSS via move_attachments_page.php. Affects mantisbt/mantisbt across 3 version ranges.
< 1.3.9
>= 2.0.0, < 2.1.3
>= 2.2.0, < 2.2.3
Fixed in 1.3.9, 2.1.3 or 2.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that helps teams manage and track software development projects. It provides features such as bug tracking, project management, and collaboration tools. However, like many web applications, it can be vulnerable to security issues, including cross-site scripting (XSS) vulnerabilities. This specific vulnerability affects the Move Attachments page, which is part of the admin tools, allowing attackers to exploit it if certain conditions are met.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability exists in the MantisBT Move Attachments page (move_attachments_page.php). This flaw allows remote attackers to inject arbitrary code through a crafted 'type' parameter, provided that the Content Security Protection (CSP) settings permit it. The vulnerability can lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive information. It is classified under CWE-79, indicating that it is an issue related to improper neutralization of input.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.91.3.9composer require mantisbt/mantisbt:1.3.9 -
>= 2.0.0, < 2.1.32.1.3composer require mantisbt/mantisbt:2.1.3 -
>= 2.2.0, < 2.2.32.2.3composer require mantisbt/mantisbt:2.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can remove the admin tools directory from your MantisBT installation. This will prevent access to the vulnerable Move Attachments page until you can apply the necessary updates.
Conclusion
The CVE-2017-7241 vulnerability in MantisBT allows for potential XSS attacks through the Move Attachments page. It is crucial to update to the latest patched versions to secure your application. Additionally, removing the admin tools directory can serve as a temporary workaround until updates are applied.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 4.8, indicating a moderate level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this XSS vulnerability could allow attackers to perform actions on behalf of users, potentially leading to data theft or unauthorized access.
Using an outdated version of MantisBT that is vulnerable to this XSS issue poses a security risk. It is highly recommended to update to a patched version.
If you cannot update immediately, ensure that you remove the admin tools directory as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
