Read the docs
TI-2017-04925 Aliases CVE-2017-7241GHSA-x53v-v9xp-gf6g

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page…

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Why it matters now

EPSS 0.00929 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mantisbt/mantisbt (Packagist): 1.3.9, 2.1.3, 2.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—mantisbt/mantisbt (Packagist)before 1.3.91.3.9Patch availableGHSA-x53v-v9xp-gf6g
—mantisbt/mantisbt (Packagist)2.0.0 to before 2.1.32.1.3Patch availableGHSA-x53v-v9xp-gf6g
—mantisbt/mantisbt (Packagist)2.2.0 to before 2.2.32.2.3Patch availableGHSA-x53v-v9xp-gf6g
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • mantisbt/mantisbt (Packagist) Vendor— Affected before 1.3.9 Fixed in 1.3.9 Patch available GHSA-x53v-v9xp-gf6g
  • mantisbt/mantisbt (Packagist) Vendor— Affected 2.0.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-x53v-v9xp-gf6g
  • mantisbt/mantisbt (Packagist) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-x53v-v9xp-gf6g

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:*1.2.16Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.2.17:*:*:*:*:*:*:*1.2.17Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.2.18:*:*:*:*:*:*:*1.2.18Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.2.19:*:*:*:*:*:*:*1.2.19Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.2.20:*:*:*:*:*:*:*1.2.20Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta1:*:*:*:*:*:*1.3.0 beta1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta2:*:*:*:*:*:*1.3.0 beta2Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta3:*:*:*:*:*:*1.3.0 beta3Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc1:*:*:*:*:*:*1.3.0 rc1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc2:*:*:*:*:*:*1.3.0 rc2Vulnerablemantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:* Versions 1.2.16 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.2.17:*:*:*:*:*:*:* Versions 1.2.17 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.2.18:*:*:*:*:*:*:* Versions 1.2.18 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.2.19:*:*:*:*:*:*:* Versions 1.2.19 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.2.20:*:*:*:*:*:*:* Versions 1.2.20 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta1:*:*:*:*:*:* Versions 1.3.0 beta1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta2:*:*:*:*:*:* Versions 1.3.0 beta2 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta3:*:*:*:*:*:* Versions 1.3.0 beta3 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc1:*:*:*:*:*:* Versions 1.3.0 rc1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc2:*:*:*:*:*:* Versions 1.3.0 rc2 Vulnerable ·mantisbt
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mantisbt:mantisbt:1.3.1:*:*:*:*:*:*:*1.3.1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.2:*:*:*:*:*:*:*1.3.2Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.3:*:*:*:*:*:*:*1.3.3Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.4:*:*:*:*:*:*:*1.3.4Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.5:*:*:*:*:*:*:*1.3.5Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.6:*:*:*:*:*:*:*1.3.6Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.7:*:*:*:*:*:*:*1.3.7Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.8:*:*:*:*:*:*:*1.3.8Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:1.3.9:*:*:*:*:*:*:*1.3.9Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.1.0:*:*:*:*:*:*:*2.1.0Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.2.0:*:*:*:*:*:*:*2.2.0Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.2.1:*:*:*:*:*:*:*2.2.1Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.2.2:*:*:*:*:*:*:*2.2.2Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.2.3:*:*:*:*:*:*:*2.2.3Vulnerablemantisbt
cpe:2.3:a:mantisbt:mantisbt:2.3.0:*:*:*:*:*:*:*2.3.0Vulnerablemantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.7:*:*:*:*:*:*:* Versions 1.3.7 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.8:*:*:*:*:*:*:* Versions 1.3.8 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·mantisbt

Remediation

  • Fix · GHSA-x53v-v9xp-gf6g mantisbt/mantisbt (Packagist) Fixed in 1.3.9 Advisory →
  • Fix · GHSA-x53v-v9xp-gf6g mantisbt/mantisbt (Packagist) Fixed in 2.1.3 Advisory →
  • Fix · GHSA-x53v-v9xp-gf6g mantisbt/mantisbt (Packagist) Fixed in 2.2.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7241
  2. 2026-10-03 Alias added: GHSA-x53v-v9xp-gf6g

References

Exploit 1

Advisory 2

Other 4

  • TI-2017-05251 MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access… CVSS 3.1HIGH 8.8
  • TI-2014-05966 The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2025-38760 MantisBT unauthorized disclosure of private project column configuration CVSS 4.0MEDIUM 5.3
  • TI-2017-04981 A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page… CVSS 3.0MEDIUM 4.8
  • TI-2019-11797 MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2014-07063 The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows… CVSS 2.0MEDIUM 6.4
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences