CVE-2016-6837: XSS
Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'viewtype' parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6837?
CVE-2016-6837 is classified as a medium severity vulnerability due to the possibility of remote code execution via XSS.
How do I fix CVE-2016-6837?
To fix CVE-2016-6837, update MantisBT to version 1.2.19 or later, or to any stable version after 1.3.0-beta1.
What kind of attacks can exploit CVE-2016-6837?
CVE-2016-6837 can be exploited for cross-site scripting attacks, allowing attackers to inject arbitrary web scripts or HTML.
Which versions of MantisBT are affected by CVE-2016-6837?
CVE-2016-6837 affects MantisBT versions prior to 1.2.19, as well as the beta versions 1.3.0-beta1 and 2.0.0-beta1.
Is CVE-2016-6837 easy to exploit?
CVE-2016-6837 is relatively easy to exploit due to the simple nature of the XSS vulnerability that targets the 'view_type' parameter.