CVE-2017-7309: MantisBT Configuration Report page XSS via config_option parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe vulnerability requires high privileges and user interaction, limiting its exploitability, but public exploit information and a high EPSS score warrant timely patching.

What it is

MantisBT's Configuration Report page (adm_config_report.php) fails to properly sanitize the 'config_option' parameter, allowing stored or reflected cross-site scripting. The flaw is fixed in versions 1.3.9, 2.1.3, and 2.2.3. Because the vulnerable page is administrative, exploitation requires a high-privileged account and some user interaction.

Impact

An attacker who can inject script into the page can execute arbitrary code in the context of a victim's browser, potentially stealing session cookies or performing actions as the victim. The CVSS vector limits confidentiality and integrity impact to low, and the scope is changed.

Attack surface

The vulnerability is reached over the network via the adm_config_report.php page, requiring high privileges (PR:H) and user interaction (UI:R). No authentication bypass is described; the attacker must already have administrative access to inject the payload.

Exploitation

The record is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.57319, 99th percentile). References include an 'Exploit' tag on the vendor bug tracker, suggesting public exploit information exists.

What to do

• Upgrade MantisBT to version 1.3.9, 2.1.3, 2.2.3 or later.
• Restrict access to administrative pages such as adm_config_report.php to trusted users only.
• Enforce a strict Content Security Policy to limit script execution if injection occurs.
• Review and sanitize all user-supplied input, especially the config_option parameter, before rendering.

Detection

• Monitor web server logs for requests to adm_config_report.php with suspicious config_option parameter values containing script tags or event handlers.
• Search for anomalous administrative activity or unexpected configuration changes in MantisBT audit logs.
• Deploy web application firewall rules to block XSS patterns targeting the config_option parameter.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.