First published: Fri Feb 17 2017(Updated: )
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
MantisBT | <=1.3.0 | |
MantisBT | =2.0.0-beta1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-7111 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
To fix CVE-2016-7111, upgrade MantisBT to version 1.3.1 or 2.0.0-beta.2 or later.
CVE-2016-7111 allows attackers to conduct cross-site scripting (XSS) attacks via the Gravatar plugin.
CVE-2016-7111 affects MantisBT versions prior to 1.3.1 and 2.0.0-beta.2.
While there may not be specific publicly known exploits, the nature of the vulnerability allows for the possibility of XSS exploitation by remote attackers.