An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search…
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by crafting any valid parameter.
Why it matters now
EPSS 0.00574 47th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6958
- 2026-10-03 Alias added: GHSA-v2cp-6p8m-85fh
References
More mantisbt Source Integration vulnerabilities
- TI-2018-11723 An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before… CVSS 3.1MEDIUM 6.1
- TI-2020-07205 A cross-site scripting (XSS) vulnerability was discovered in the Source Integration… CVSS 3.1MEDIUM 6.1
- TI-2020-18512 An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. CVSS 3.1MEDIUM 5.3
Sources
- CVE-2017-6958 · CVE Program
- CVE-2017-6958 · NVD
- FIRST EPSS
- GHSA-v2cp-6p8m-85fh · GitHub Advisory Database · CC BY 4.0
- CVE-2017-6958 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences