CVE-2017-7620 in MantisBT
Summary
MantisBT before 2.4.1 allows Permalink Injection via CSRF attacks on a permalink_page.php?url= URI. This is caused by a lack of a backslash check in string_api.php.
Reservation
04/10/2017
Disclosure
05/21/2017
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 101526 | MantisBT permalink_page.php cross-site request forgery | 352 | Proof-of-Concept | Official fix | CVE-2017-7620 |