GHSA-x53v-v9xp-gf6g

Source

https://github.com/advisories/GHSA-x53v-v9xp-gf6g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x53v-v9xp-gf6g/GHSA-x53v-v9xp-gf6g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x53v-v9xp-gf6g

Aliases

CVE-2017-7241

Published

2022-05-17T02:30:07Z

Modified

2025-06-11T19:42:17.406820Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

MantisBT XSS via move_attachments_page.php

Details

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (moveattachmentspage.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Database specific

{
    "github_reviewed_at": "2025-06-11T18:50:10Z",
    "github_reviewed": true,
    "nvd_published_at": "2017-03-31T04:59:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE"
}

References

Affected packages

Packagist / mantisbt/mantisbt

Package

Name: mantisbt/mantisbt
Purl: pkg:composer/mantisbt/mantisbt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.9

Packagist / mantisbt/mantisbt

Package

Name: mantisbt/mantisbt
Purl: pkg:composer/mantisbt/mantisbt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.1.3

Packagist / mantisbt/mantisbt

Package

Name: mantisbt/mantisbt
Purl: pkg:composer/mantisbt/mantisbt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.3