PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5364 Mantisbt CVE debrief

CVE-2016-5364 is a cross-site scripting flaw in MantisBT's manage_custom_field_edit_page.php. NVD lists affected versions through 1.2.19, and the issue is reachable over the network with no privileges required, but it does require user interaction. The published CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which aligns with a medium-severity web injection issue.

Vendor
Mantisbt
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Teams operating MantisBT instances at version 1.2.19 or earlier, especially administrators, application owners, and security teams responsible for web application patching and validation.

Technical summary

The vulnerability is an XSS condition in manage_custom_field_edit_page.php triggered through the return parameter. Because the payload is handled in a web page context, an attacker can cause script or HTML to be rendered in a victim's browser. NVD classifies the weakness as CWE-79 and the CVSS vector shows network attackability, low attack complexity, no attacker privileges, and a user-interaction requirement.

Defensive priority

Medium priority. The issue is remotely reachable and can affect browser sessions and application trust boundaries, but it requires user interaction and NVD rates it as CVSS 6.1.

Recommended defensive actions

  • Inventory MantisBT deployments and confirm whether any instance is running version 1.2.19 or earlier.
  • Apply the vendor fixes referenced by the official advisory and patches, or upgrade to a release newer than the vulnerable range.
  • Review custom field editing and redirect/return handling for proper output encoding and HTML escaping.
  • After remediation, verify the fix in a staging environment and retest the affected page path under normal user workflows.

Evidence notes

The supplied NVD record states that MantisBT 1.2.19 and earlier are vulnerable and maps the issue to CWE-79. The record also provides a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Official references include the oss-security mailing list post, two GitHub patch commits, and the MantisBT issue tracker entry, all tied to the same vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5364 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5364

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5364 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5364

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.