NVD

Id
84781  
Name
CVE-2017-7241  
Description
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the Post-installation and upgrade tasks of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.  
Reject
 
CVSS Version
2  
CVSS Score
3.5  
Severity
Low  
CVSS Base Score
3.5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:N/I:P/A:N)  
Pub Date
2017-07-18  
Published
2017-03-31  
Modified Date
2017-07-11  
Seq
2017-7241  

Actions

Related NVD References

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
66457 JVNDB-2017-002795 MantisBT の Move Attachments ページにおけるクロスサイトスクリプティングの脆弱性 MantisBT の Move Attachments ページ (move_attachments_page.php (管理ツールの一部)) には、Content Security Protection (CSP) 設定が許可している場合、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2017-7241 0 CVE-2017-7241 84781 3.5 4.8 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-002795.html 2017-04-01 2017-04-28 View