MantisBT 1.3.0 Release Candidate 1

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc1:*:*:*:*:*:*

part: a version: 1.3.0 update: rc1

VendorMantisbt (9be8c23a-b549-5ad5-a5b6-9beba90daced)
ProductMantisbt (9ac8dfd9-fe15-55d7-90e0-68973c4eb995)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/mantisbt/mantisbt purl2cpe 2026-06-01 10:12:58.632471
pkg:rpm/opensuse/mantisbt purl2cpe 2026-06-01 10:12:58.632472

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-7241 vulnerable 2026-06-08 05:09:55.548295 Details available
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
Published: 2017-03-31T04:26:00.000Z
Updated: 2024-08-05T15:56:36.253Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2014-9759 vulnerable 2026-06-08 05:06:12.996669 Details available
Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.
Published: 2016-04-11T21:00:00.000Z
Updated: 2024-08-06T13:55:04.345Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.