CVE-2017-12061

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2

published August 1, 2017

CVSS
—
EPSS
3%
Percentile
87.0
In the wild
Unconfirmed
What it is

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02937 · 87.0th percentile
Published
2017-08-01T15:00Z
EPSS history
Timeline
  • 01 AUG 15:00Z
    An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2
    cvelistv5