CVE-2016-7111: XSS
Published Feb 17, 2017
·Updated
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Affected Software
4 affected componentsFixes available
MantisBT mantisbt<=1.3.0
MantisBT mantisbt=2.0.0-beta1
composer/mantisbt/mantisbt=2.0.0-beta.1
2.0.0-beta.2
composer/mantisbt/mantisbt<=1.3.0
1.3.1
Remediation
Patch Available
Patch Available
Patch Available
Event History
Feb 17, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
via GitHub·02:58 AM
Data Sourced
via GitHub·02:58 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-7111?
CVE-2016-7111 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2016-7111?
To fix CVE-2016-7111, upgrade MantisBT to version 1.3.1 or 2.0.0-beta.2 or later.
3
What type of attacks are possible with CVE-2016-7111?
CVE-2016-7111 allows attackers to conduct cross-site scripting (XSS) attacks via the Gravatar plugin.
4
Which versions of MantisBT are affected by CVE-2016-7111?
CVE-2016-7111 affects MantisBT versions prior to 1.3.1 and 2.0.0-beta.2.
5
Is there a known exploit for CVE-2016-7111?
While there may not be specific publicly known exploits, the nature of the vulnerability allows for the possibility of XSS exploitation by remote attackers.