CVE-2016-7111: MantisBT XSS Vulnerability via Weak CSP in Gravatar Plugin
Summary
CVE-2016-7111: MantisBT XSS through weak CSP when using Gravatar plugin. Affects mantisbt/mantisbt across 2 version ranges.
< 1.3.1
>= 2.0.0-beta.1, < 2.0.0-beta.2
Fixed in 1.3.1 or 2.0.0-beta.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that provides a user-friendly interface for managing software development projects. It allows users to report bugs, track issues, and collaborate on project management. The Gravatar plugin enables users to display avatars associated with their email addresses, enhancing user interaction. However, prior versions of MantisBT are susceptible to a cross-site scripting (XSS) vulnerability due to a weak Content Security Policy (CSP) when using this plugin.
Vulnerability Detail
The vulnerability arises from the implementation of a weak Content Security Policy in MantisBT versions before 1.3.1 and 2.x before 2.0.0-beta.2. This weakness allows remote attackers to exploit unspecified vectors to conduct cross-site scripting (XSS) attacks. Such attacks can lead to unauthorized access to user sessions, data theft, or the injection of malicious scripts into web pages viewed by other users, compromising the integrity and security of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.11.3.1composer require mantisbt/mantisbt:1.3.1 -
>= 2.0.0-beta.1, < 2.0.0-beta.22.0.0-beta.2composer require mantisbt/mantisbt:2.0.0-beta.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the Gravatar plugin until the application is updated to a secure version. This can be done by navigating to the plugin settings in MantisBT and disabling the Gravatar functionality.
Conclusion
The CVE-2016-7111 vulnerability in MantisBT poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly advised to update their installations to the latest patched versions to safeguard against these threats. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The vulnerability allows attackers to perform cross-site scripting (XSS) attacks, potentially leading to data theft and unauthorized access to user accounts.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
MantisBT versions before 1.3.1 and 2.x before 2.0.0-beta.2 are affected by this vulnerability.
As a temporary measure, consider disabling the Gravatar plugin to mitigate the risk of XSS attacks until you can perform the update.
The CVSS score for this vulnerability is 4.7, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
