MantisBT allows arbitrary password reset

published 2017-04-16 9 y ago modified 2026-06-17 4 mo ago also GHSA-252r-f55f-ff34 , EUVD-2017-16620

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 91.2%; EPSS 91.2% chance of exploitation in 30 days, percentile 99.8%
public exploits: 3; Metasploit, Exploit-DB, plus a Nuclei check

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

Patch / fix

fixed in 1 links 1

packagist mantisbt/mantisbt 1.3.10, 2.2.4, 2.3.1

mantisbt.org/bugs/view.php?id=22690 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7615 updated 2025-11-21 cvss 9.8

mantis: Arbitrary password reset

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2017-04-16 First public exploit (Metasploit auxiliary/admin/http/mantisbt_password_reset)
2017-04-16 Published

Exploit prediction

91.20% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/admin/http/mantisbt_password_reset MantisBT password reset metasploit auxiliary, normal rank, 2017-04-16
EDB-48818 Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated) webapps, 2020-09-18
EDB-41890 Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset webapps, 2017-04-16
Nuclei template MantisBT <=2.30 - Arbitrary Password Reset/Admin Access nuclei detection template
hyp3rlinx.altervista.org http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	mantisbt/mantisbt	>=1.3.0-rc.2, <1.3.10 >=2.0.0, <2.2.4 >=2.3.0, <2.3.1	1.3.10 2.2.4 2.3.1

Classification

Weakness

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

References

mantisbt.org /bugs/view.php?id=22690
web, issue-tracking, patch, vendor-advisory
exploit-db.com /exploits/41890/
exploit, third-party-advisory, vdb-entry
hyp3rlinx.altervista.org /advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
web, exploit, third-party-advisory
packetstormsecurity.com /files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html
web, exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/97707
vdb-entry, web, broken-link, third-party-advisory
openwall.com /lists/oss-security/2017/04/16/2
web, mailing-list, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2017-7615
advisory
github.com /mantisbt/mantisbt
package
exploit-db.com /exploits/41890
web

Sources

CVE List CVE-2017-7615
GitHub Advisory GHSA-252r-f55f-ff34
NVD CVE-2017-7615

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary