CVE-2017-12061

MEDIUM

MantisBT < 1.3.12 and 2.x < 2.5.2 - Cross-Site Scripting via Installation Script Variables

Title source: llm
STIX 2.1

Description

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.

References (6)

Core 6
Core References
Mailing List, Third Party Advisory x_refsource_confirm
http://openwall.com/lists/oss-security/2017/08/01/1
Issue Tracking, Vendor Advisory x_refsource_confirm
https://mantisbt.org/bugs/view.php?id=23146
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039030
Mailing List, Third Party Advisory x_refsource_confirm
http://openwall.com/lists/oss-security/2017/08/01/2

Scores

CVSS v3 6.1
EPSS 0.0295
EPSS Percentile 85.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
mantisbt/mantisbt 0 - 1.3.12Packagist
mantisbt/mantisbt 1.3.0 - 1.3.12
Published Aug 01, 2017
Tracked Since Feb 18, 2026