PT-2017-9085 · Mantisbt+1 · Mantisbt+1

J_Schultz · Published 2017-02-17 · Updated 2022-05-17 · CVE-2016-7111

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.3.1 MantisBT versions 2.x prior to 2.0.0-beta.2

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors when the Gravatar plugin is used, due to a weak Content Security Policy.

Recommendations For MantisBT versions prior to 1.3.1, update to version 1.3.1 or later. For MantisBT versions 2.x prior to 2.0.0-beta.2, update to version 2.0.0-beta.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-7111

GHSA-8VX9-HCVQ-GFV8

Affected Products

Gravatar

Mantisbt

References · 9

• https://github.com/mantisbt/mantisbt/commit/b3511d2f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-7111 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7111 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/08/29/2 · Patch
• https://osv.dev/vulnerability/GHSA-8vx9-hcvq-gfv8 · Vendor Advisory
• https://mantisbt.org/bugs/view.php?id=21263 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/b3511d2feb47eaee41feb5f69cf3c8a2c9acd229 · Note
• http://openwall.com/lists/oss-security/2016/08/28/1 · Note