PT-2017-9085 · Mantisbt+1 · Mantisbt+1

J_Schultz · Publicado 2017-02-17 · Atualizado 2022-05-17 · CVE-2016-7111

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.3.1 MantisBT versions 2.x prior to 2.0.0-beta.2

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors when the Gravatar plugin is used, due to a weak Content Security Policy.

Recommendations For MantisBT versions prior to 1.3.1, update to version 1.3.1 or later. For MantisBT versions 2.x prior to 2.0.0-beta.2, update to version 2.0.0-beta.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-7111

GHSA-8VX9-HCVQ-GFV8

Produtos afetados

Gravatar

Mantisbt

Referências · 9

• https://github.com/mantisbt/mantisbt · Nota
• https://github.com/mantisbt/mantisbt/commit/b3511d2feb47eaee41feb5f69cf3c8a2c9acd229 · Nota
• https://github.com/mantisbt/mantisbt/commit/b3511d2f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-7111 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7111 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/08/29/2 · Correção
• https://osv.dev/vulnerability/GHSA-8vx9-hcvq-gfv8 · Aviso do Fabricante
• https://mantisbt.org/bugs/view.php?id=21263 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/08/28/1 · Nota