CVE-2017-7309

2017-03-3104:26:00

mitre

www.cve.org

4.9 Medium

AI Score

Confidence

High

0.053 Low

EPSS

Percentile

93.1%

JSON

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted ‘config_option’ parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.