CVE-2017-6973

2017-03-3104:59:00

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.9%

JSON

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted ‘action’ parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

CPENameOperatorVersion
mantisbteqrelease-1.3.3
mantisbteqrelease-1.3.0
mantisbteqrelease-1.3.5
mantisbteqrelease-1.2.0rc1
mantisbteqrelease-2.0.0-beta.1
mantisbteqrelease-2.0.0-rc.2
mantisbteqrelease-2.0.0
mantisbteqrelease-2.1.0
mantisbteqrelease-1.3.0-beta.3
mantisbteqrelease-2.0.0-rc.1

Name	Operator	Version
mantisbt	eq	release-1.3.3
mantisbt	eq	release-1.3.0
mantisbt	eq	release-1.3.5
mantisbt	eq	release-1.2.0rc1
mantisbt	eq	release-2.0.0-beta.1
mantisbt	eq	release-2.0.0-rc.2
mantisbt	eq	release-2.0.0
mantisbt	eq	release-2.1.0
mantisbt	eq	release-1.3.0-beta.3
mantisbt	eq	release-2.0.0-rc.1