CVE-2017-7897

Summary: CVE-2017-7897 is an XSS vulnerability in MantisBT 2.3.x before 2.3.2, triggered via crafted PATH_INFO in URLs on the Timeline include page used by My View (my_view_page.php) and User Information (view_user_page.php). The root cause is unsanitized $_SERVER['PHP_SELF'] used to generate URL...