CVE-2017-7897

A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information…

published April 18, 2017

CVSS
—
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01754 · 77.6th percentile
Published
2017-04-18T17:00Z
EPSS history
Timeline
  • 18 APR 17:00Z
    A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information…
    cvelistv5