GCVE - cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta1:*:*:*:*:*:*

part: a version: 2.0.0 update: beta1

Vendor	Mantisbt (`9be8c23a-b549-5ad5-a5b6-9beba90daced`)
Product	Mantisbt (`9ac8dfd9-fe15-55d7-90e0-68973c4eb995`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mantisbt/mantisbt`	purl2cpe	2026-06-01 10:12:58.632533
`pkg:rpm/opensuse/mantisbt`	purl2cpe	2026-06-01 10:12:58.632534

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7309`	vulnerable	2026-06-08 05:09:55.736776	Details available A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Published: 2017-03-31T04:26:00.000Z Updated: 2024-08-05T15:56:36.454Z Open on db.gcve.eu Reference links http://www.mantisbt.org/bugs/view.php?id=22579 http://openwall.com/lists/oss-security/2017/03/30/4 http://www.securitytracker.com/id/1038169 http://www.securityfocus.com/bid/97251	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7241`	vulnerable	2026-06-08 05:09:55.548552	Details available A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page. Published: 2017-03-31T04:26:00.000Z Updated: 2024-08-05T15:56:36.253Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2017/03/30/4 http://www.securitytracker.com/id/1038169 http://www.mantisbt.org/bugs/view.php?id=22568 http://www.securityfocus.com/bid/97253	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6973`	vulnerable	2026-06-08 05:09:55.219579	Details available A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2. Published: 2017-03-31T04:26:00.000Z Updated: 2024-08-05T15:49:02.931Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2017/03/30/4 http://www.securitytracker.com/id/1038169 http://www.mantisbt.org/bugs/view.php?id=22537 http://www.securityfocus.com/bid/97252	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-7111`	vulnerable	2026-06-08 05:08:11.834882	Details available MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. Published: 2017-02-17T17:00:00.000Z Updated: 2024-08-06T01:50:47.577Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2016/08/28/1 http://www.openwall.com/lists/oss-security/2016/08/29/2 https://github.com/mantisbt/mantisbt/commit/b3511d2f https://mantisbt.org/bugs/view.php?id=21263	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6837`	vulnerable	2026-06-08 05:08:11.177835	Details available Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter. Published: 2017-01-10T15:00:00.000Z Updated: 2024-08-06T01:43:38.433Z Open on db.gcve.eu Reference links https://github.com/mantisbt/mantisbt/commit/7086c2d8b4b20ac14013b36761ac04f0abf21a4e https://mantisbt.org/bugs/view.php?id=21611 http://www.securitytracker.com/id/1036655 http://www.securityfocus.com/bid/92522	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.