CVE-2017-7309

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code…

published March 31, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
57%
Percentile
99.1
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.57319 · 99.1th percentile
Published
2017-03-31T04:26Z
EPSS history
Timeline
  • 22 SEP 03:14Z
    EPSS moved 57% → 25%
    epss
  • 06 SEP 03:11Z
    EPSS moved 57% → 25%
    epss
  • 30 AUG 15:59Z
    EPSS moved 25% → 57%
    epss
  • 29 AUG 04:26Z
    EPSS moved 57% → 25%
    epss
  • 31 MAR 04:26Z
    A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code…
    cvelistv5