PT-2002-2113 · Mantis · Mantis

Publicado 2002-09-10 · Atualizado 2016-10-18 · CVE-2002-1110

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mantis versions 0.17.2 and earlier

Description: The issue allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, for example, to the "account update.php" endpoint, when running without magic quotes gpc enabled.

Recommendations: For Mantis versions 0.17.2 and earlier, consider disabling the account update functionality until a patch is available, and ensure magic quotes gpc is enabled to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-1110

DSA-153

Produtos afetados

Mantis

Referências · 6

• http://debian.org/security/2002/dsa-153 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1110 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=102978728718851&w=2 · Nota
• http://mantisbt.sourceforge.net/advisories/2002/2002-01.txt · Nota
• http://securityfocus.com/bid/5510 · Aviso do Fabricante
• http://iss.net/security_center/static/9897.php · Nota