CVE-2017-7620 is a medium-severity (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in mantisbt/mantisbt. 3 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for mantisbt/mantisbt — see the affected versions and patch details below.
MantisBT vulnerable to CSRF and Open Redirect attacks
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
mantisbt/mantisbt🐘mantisbt/mantisbt🐘mantisbt/mantisbtReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial / substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | mantisbt/mantisbt | all versions | 1.3.11composer require mantisbt/mantisbt:^1.3.11 |
| 🐘Packagist | mantisbt/mantisbt | ≥ 2.0.0&&< 2.3.3 | 2.3.3composer require mantisbt/mantisbt:^2.3.3 |
| 🐘Packagist | mantisbt/mantisbt | ≥ 2.4.0&&< 2.4.1 | 2.4.1composer require mantisbt/mantisbt:^2.4.1 |
Affected Products
mantisbtmantisbtResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery
by hyp3rlinx · May 20, 2017
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mantisbt/mantisbt, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update mantisbt/mantisbt to 1.3.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2017-7620 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2017-7620 in your dependencies?
Find it across Packagist, including transitive dependencies.