CVE-2017-7897: MantisBT XSS via my_view_page.php and view_user_page.php

May 17, 2022 (updated June 4, 2025)

A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER[‘PHP_SELF’] to generate URLs.

References

github.com/advisories/GHSA-8r2m-qhff-jm2c
github.com/mantisbt/mantisbt
github.com/mantisbt/mantisbt/commit/a1c719313d61b07bbe8700005807b8195fdc32f1
github.com/mantisbt/mantisbt/pull/1094
nvd.nist.gov/vuln/detail/CVE-2017-7897

Code Behaviors & Features

Detect and mitigate CVE-2017-7897 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →