CVE-2016-7111

MEDIUM

Mantisbt < 1.3.0 - XSS

Title source: rule

Description

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

References (4)

Scores

CVSS v3 4.7
EPSS 0.0033
EPSS Percentile 55.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-79
Status published

Affected Products (4)

mantisbt/mantisbt < 1.3.0
mantisbt/mantisbt
mantisbt/mantisbt < 1.3.1Packagist
n/a/n/a

Timeline

Published Feb 17, 2017
Tracked Since Feb 18, 2026