CVE-2017-7309
1 advisory.
Packagist/mantisbt/mantisbt CVE-2017-7309: medium 4.8
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
Action: Upgrade mantisbt/mantisbt to 1.3.9 or later.
composer require mantisbt/mantisbt:1.3.9composer require mantisbt/mantisbt:2.1.3composer require mantisbt/mantisbt:2.2.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.9 | - |
| 2.1.0 | 2.1.3 | - |
| 2.2.0 | 2.2.3 | - |
Fixed versions
| 1.3.9 | 2.1.3 | 2.2.3 |
Sources
- osv: GHSA-4w6c-3hcx-rfj5
- https://nvd.nist.gov/vuln/detail/CVE-2017-7309
- https://github.com/mantisbt/mantisbt/commit/0243375e32bc24878e309f3d6ef6d8cfb3e2f278
- https://github.com/mantisbt/mantisbt/commit/c9e5b1d0404503022605459552faeaf610bf15ae
- https://github.com/mantisbt/mantisbt/commit/e881dd79df422033bbea88914fc0a717fae40358
- https://github.com/mantisbt/mantisbt
- http://openwall.com/lists/oss-security/2017/03/30/4
- http://www.mantisbt.org/bugs/view.php?id=22579
CVE-2017-7309 · published · modified · JSON