GCVE - cpe:2.3:a:mantisbt:mantisbt:2.3.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:2.3.0:*:*:*:*:*:*:*

part: a version: 2.3.0 update: *

Vendor	Mantisbt (`9be8c23a-b549-5ad5-a5b6-9beba90daced`)
Product	Mantisbt (`9ac8dfd9-fe15-55d7-90e0-68973c4eb995`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mantisbt/mantisbt`	purl2cpe	2026-06-01 10:12:58.659950
`pkg:rpm/opensuse/mantisbt`	purl2cpe	2026-06-01 10:12:58.659952

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7897`	vulnerable	2026-06-08 05:10:06.304725	Details available A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs. Published: 2017-04-18T17:00:00.000Z Updated: 2024-08-05T16:19:29.330Z Open on db.gcve.eu Reference links http://www.mantisbt.org/bugs/view.php?id=22742 http://www.securitytracker.com/id/1038278 https://github.com/mantisbt/mantisbt/commit/a1c719313d61b07bbe8700005807b8195fdc32f1 https://github.com/mantisbt/mantisbt/pull/1094	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7241`	vulnerable	2026-06-08 05:09:55.552748	Details available A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page. Published: 2017-03-31T04:26:00.000Z Updated: 2024-08-05T15:56:36.253Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2017/03/30/4 http://www.securitytracker.com/id/1038169 http://www.mantisbt.org/bugs/view.php?id=22568 http://www.securityfocus.com/bid/97253	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12062`	vulnerable	2026-06-08 05:08:38.680282	Details available An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled. Published: 2017-08-01T15:00:00.000Z Updated: 2024-08-05T18:28:15.058Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2017/08/01/1 http://www.securitytracker.com/id/1039030 https://mantisbt.org/bugs/view.php?id=23166 http://openwall.com/lists/oss-security/2017/08/01/2 https://github.com/mantisbt/mantisbt/commit/9b5b71dadbeeeec27efea59f562ac5bd6d2673b7	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.