CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: a cross-site scripting (xss) vulnerability in mantisbt before 2.1.1 allows remote attackers to inject arbitrary html or javascript (if mantisbt's csp settings permit it) by modifying 'window_title' in the application configuration. this requires privileged access to mantisbt configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php).
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2017-03-22
Last Modified Date: 2017-03-23