MantisBT weakened CSP when using bundled Gravatar plugin

[Damien Regad <dregad () mantisbt org>]

Greetings,

Please assign a CVE ID for the following issue.

Description
-----------
MantisBT 1.3.0-rc.2 introduced a new bundled plugin to handle display of
users' avatars using Gravatar.

Instead of adding the Gravatar web site to the list of allowed image
sources in MantisBT's Content Security Policy, the plugin was replacing
the whole policy by:

   img-src 'self' http://www.gravatar.com/

instead of the more strict default one of:

   default-src 'self'; frame-ancestors 'none'; style-src 'self';
   script-src 'self'

Relaxed policy allows execution of remote and inline scripts, e.g.
potentially enabling XSS attacks.


Affected versions
-----------------
- >= 1.3.0-rc.2
- >= 2.0.0-beta.1

Fixed in versions:
------------------
- 1.3.1
- 2.0.0-beta.2

As of this writing, these have not been released yet, but both should be
available in the coming days. Until then, installations should be
patched manually.

As a workaround, disabling the Gravatar plugin restores the safer
default policy.

Patch
-----
See Github [1]

Credits
-------
The issue was discovered by Johannes Schultz, and fixed by Victor Boctor
(MantisBT Developer).

References
----------
Further details available in our issue tracker [2]


Best regards,
D. Regad
MantisBT Developer
http://mantisbt.org


[1] https://github.com/mantisbt/mantisbt/commit/b3511d2f
[2] https://mantisbt.org/bugs/view.php?id=21263