GitHub Advisoryadvisory · Packagist

GHSA-8vx9-hcvq-gfv8 MantisBT XSS through weak CSP when using Gravatar plugin

MEDIUM Published 2022-05-17 Modified 2025-06-11 Official page ↗
Aliases
CVE-2016-7111
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-06-11

Affected packages

• Packagist mantisbt/mantisbt: < 1.3.1 → fixed in 1.3.1 • Packagist mantisbt/mantisbt: >= 2.0.0-beta.1, < 2.0.0-beta.2 → fixed in 2.0.0-beta.2

Description

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2016-7111 MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References