GHSA-v7qf-22rw-chphMediumCVSS 4.8

MantisBT XSS via adm_config_report.php's action parameter

Published
May 17, 2022
Last Modified
June 11, 2025

🔗 CVE IDs covered (1)

CVE-2017-6973 →

📋 Description

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

🎯 Affected products3

  • composer/mantisbt/mantisbt:< 1.3.8
  • composer/mantisbt/mantisbt:>= 2.0.0, < 2.1.2
  • composer/mantisbt/mantisbt:>= 2.2.0, < 2.2.2

🔗 References (6)