CVE-2017-7897
- Source
- https://cve.org/CVERecord?id=CVE-2017-7897
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-7897.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-7897
- Aliases
- Published
- 2017-04-18T17:59:00.163Z
- Modified
- 2026-05-17T11:54:09.942270345Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (myviewpage.php) and User Information (viewuserpage.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $SERVER['PHPSELF'] to generate URLs.
- References