Cross site scripting

2017-03-3104:59:00

PRIOn knowledge base

www.prio-n.com

5 Medium

AI Score

Confidence

High

0.053 Low

EPSS

Percentile

93.1%

JSON

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted ‘config_option’ parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.

CPENameOperatorVersion
mantisbteq2.1.0
mantisbteq2.0.0 rc1
mantisbteq2.1.2
mantisbteq1.3.4
mantisbteq2.1.3
mantisbteq1.3.0 rc2
mantisbteq2.0.0 beta3
mantisbteq2.1.1
mantisbteq2.2.2
mantisbteq2.2.1

Name	Operator	Version
mantisbt	eq	2.1.0
mantisbt	eq	2.0.0 rc1
mantisbt	eq	2.1.2
mantisbt	eq	1.3.4
mantisbt	eq	2.1.3
mantisbt	eq	1.3.0 rc2
mantisbt	eq	2.0.0 beta3
mantisbt	eq	2.1.1
mantisbt	eq	2.2.2
mantisbt	eq	2.2.1