CVE-2017-7309

What it actually does

Allows remote injection of arbitrary JavaScript into the Configuration Report page via a crafted config_option parameter when content security policy settings permit execution.

Why it matters to the business

Attackers could hijack administrative sessions to steal sensitive configuration data or perform unauthorized changes, increasing risk of broader system compromise in environments where the vulnerable version remains deployed.

How an attack unfolds

An attacker crafts a malicious URL containing executable script in the config_option parameter, then tricks an authenticated administrator into visiting the page; if CSP allows, the script executes in the admin's browser context to exfiltrate data or perform actions.

How to fix it

Upgrade MantisBT to version 1.3.9, 2.1.3, or 2.2.3 or later; for the listed mc packages, ensure deployment uses the fixed version 0 or equivalent patched build.

How to confirm the fix worked

Confirm the installed version matches or exceeds 1.3.9/2.1.3/2.2.3, review CSP headers to ensure they block inline scripts, and test the config_option parameter with benign input to verify sanitization.

Typical attack path

1. Identify exposed MantisBT instance with Configuration Report page accessible
2. Craft URL with malicious payload in config_option parameter
3. Deliver link via phishing or other social engineering to authenticated administrator
4. Script executes in browser if CSP permits, enabling session hijacking or data theft

How to detect it

Review web server access logs for unusual or encoded values in the config_option parameter on adm_config_report.php requests; inspect browser console or proxy logs for unexpected script execution originating from the configuration report page.

What your security team should do

• Prioritize upgrade to fixed MantisBT versions immediately given public exploit availability
• Audit CSP settings on the application to block script execution from untrusted sources
• Monitor for any administrative access to adm_config_report.php from unexpected sources