p PatchFirst

CVE-2017-12062

CVE-2017-12062

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

CVSS 6.1 · Medium · EPSS 3.9% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mantisbt/mantisbt Packagist

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.5.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.5.2

    Update to 2.5.2

Original sources

Check your server →