CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php

published April 16, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.

CVSS
—
EPSS
91%
Percentile
99.8
In the wild
Unconfirmed
What it is

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.91196 · 99.8th percentile
Published
2017-04-16T14:45Z
EPSS history
Timeline
  • 16 APR 14:45Z
    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php
    cvelistv5