GCVE - cpe:2.3:a:mantisbt:mantisbt:1.2.18:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:1.2.18:*:*:*:*:*:*:*

part: a version: 1.2.18 update: *

Vendor	Mantisbt (`9be8c23a-b549-5ad5-a5b6-9beba90daced`)
Product	Mantisbt (`9ac8dfd9-fe15-55d7-90e0-68973c4eb995`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mantisbt/mantisbt`	purl2cpe	2026-06-01 10:12:58.632431
`pkg:rpm/opensuse/mantisbt`	purl2cpe	2026-06-01 10:12:58.632432

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7241`	vulnerable	2026-06-08 05:09:55.544828	Details available A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page. Published: 2017-03-31T04:26:00.000Z Updated: 2024-08-05T15:56:36.253Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2017/03/30/4 http://www.securitytracker.com/id/1038169 http://www.mantisbt.org/bugs/view.php?id=22568 http://www.securityfocus.com/bid/97253	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2046`	vulnerable	2026-06-08 05:06:27.300544	Details available Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. Published: 2017-08-28T15:00:00.000Z Updated: 2024-08-06T05:02:43.218Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1191130 http://www.openwall.com/lists/oss-security/2015/02/21/2 http://www.openwall.com/lists/oss-security/2015/02/21/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1042`	vulnerable	2026-06-08 05:06:24.878542	Details available The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. Published: 2015-02-10T20:00:00.000Z Updated: 2024-08-06T04:33:20.326Z Open on db.gcve.eu Reference links https://www.mantisbt.org/bugs/view.php?id=17997 http://www.securitytracker.com/id/1031633 http://www.openwall.com/lists/oss-security/2015/01/10/5 http://www.openwall.com/lists/oss-security/2015/01/11/8 http://seclists.org/fulldisclosure/2015/Jan/110	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.