CVE-2017-7222

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-7222

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7222.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-7222

Published

2017-03-22T05:59:00.190Z

Modified

2026-07-08T16:53:29.683314Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (configinc.php).

References

Affected packages

Git / github.com/mantisbt/mantisbt

Affected ranges

Type

GIT

Repo

https://github.com/mantisbt/mantisbt

Events

Introduced

Last affected

9f117fd951fbde716077b1453e0ecba9dbdc588a

Fixed

a85b0b96c8ebe3e010d0d016cf88ab3c8bfc196a

Database specific

{
    "cpe": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.1.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

release-1.*

release-1.2.0a1

release-1.2.0a2

release-1.2.0a3

release-1.2.0rc1

release-1.3.0-beta.1

release-1.3.0-beta.2

release-1.3.0-beta.3

release-1.3.0-rc.1

release-1.3.0-rc.2

release-2.*

release-2.0.0

release-2.0.0-beta.1

release-2.0.0-beta.2

release-2.0.0-beta.3

release-2.0.0-rc.1

release-2.0.0-rc.2

release-2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7222.json"