PT-2005-3920 · Mantis · Mantis

Jose Antonio Coret + 1 · Publicado 2005-09-28 · Atualizado 2016-10-18 · CVE-2005-3090

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mantis versions 0.19.0a1 through 1.0.0a3

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the summary of the bug. This occurs because the summary is not properly quoted when the view all bug page.php page is used to delete the bug.

Recommendations For Mantis versions 0.19.0a1 through 1.0.0a3, consider updating to a version where this issue is fixed, although the specific fixed version is not provided in the available data. As a temporary workaround, restrict the ability to inject arbitrary web script or HTML via the bug summary to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3090

Produtos afetados

Mantis

Referências · 3

• http://marc.info/?l=bugtraq&m=112786017426276&w=2 · Nota
• http://debian.org/security/2005/dsa-778 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3090 · Nota de Segurança