CVE-2017-7222

A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings…

published March 22, 2017

CVSS
—
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00813 · 56.3th percentile
Published
2017-03-22T05:31Z
EPSS history
Timeline
  • 22 MAR 05:31Z
    A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings…
    cvelistv5