Back to search
CVE-2016-7111
Published: Feb 17, 2017
Modified: Aug 6, 2024
PUBLISHED
Description
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
[oss-security] 20160827 MantisBT weakened CSP when using bundled Gravatar plugin
mailing-list
x_refsource_MLIST
[oss-security] 20160829 Re: MantisBT weakened CSP when using bundled Gravatar plugin
mailing-list
x_refsource_MLIST
https://github.com/mantisbt/mantisbt/commit/b3511d2f
x_refsource_CONFIRM
https://mantisbt.org/bugs/view.php?id=21263
x_refsource_CONFIRM
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now