Cross-Site Scripting Vulnerability in MantisBT Source Integration Plugin
CVE-2017-6958

6.1MEDIUM

Key Information:

Vendor

Mantisbt

Status
Source Integration
Vendor
CVE Published:
17 March 2017

What is CVE-2017-6958?

An XSS vulnerability exists in the MantisBT Source Integration Plugin, specifically in the search result page functionality. This vulnerability allows attackers to inject malicious HTML or JavaScript into the page by manipulating valid search parameters. If MantisBT's Content Security Policy (CSP) settings are permissive, the injected scripts can execute, potentially leading to unauthorized actions or data exposure.

References

https://github.com/mantisbt-plugins/source-integration/is...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.