CVE-2017-7620

Packagist/mantisbt/mantisbt CVE-2017-7620: medium 6.5

MantisBT vulnerable to CSRF and Open Redirect attacks

Action: Upgrade mantisbt/mantisbt to 1.3.11 or later.

composer require mantisbt/mantisbt:1.3.11

composer require mantisbt/mantisbt:2.3.3

composer require mantisbt/mantisbt:2.4.1

Affected

Fixed versions

Sources

• osv: GHSA-9x76-mp7r-2xc5
• https://nvd.nist.gov/vuln/detail/CVE-2017-7620
• https://github.com/mantisbt/mantisbt/commit/2d2309a384bcd9d4b6d7d2928e8ded2c46d2d7b0
• https://github.com/mantisbt/mantisbt/commit/8b6787c8d321ee0ced5fb74ac3f34b67b4b7b26c
• https://github.com/mantisbt/mantisbt/commit/c4f50e5df6b189abb1d717a5f7dbab5cbfef8165
• https://github.com/mantisbt/mantisbt
• https://mantisbt.org/bugs/view.php?id=22702
• https://mantisbt.org/bugs/view.php?id=22816
• https://www.exploit-db.com/exploits/42043
• http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt

CVE-2017-7620 · published 2022-05-17T02:34:08Z · modified 2025-04-22T19:27:13.460681Z · JSON