PT-2006-7176 · Mantis · Mantis

Publicado 2006-12-15 · Atualizado 2017-07-29 · CVE-2006-6574

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mantis versions prior to 1.1.0a2

Description The issue concerns the lack of per-item access control for Issue History (Bug History), allowing remote attackers to obtain sensitive information by reading the Change column. This can be demonstrated by accessing the Change column of a custom field.

Recommendations For versions prior to 1.1.0a2, update to version 1.1.0a2 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2006-6574

DSA-1467-1

Produtos afetados

Mantis

Referências · 13

• http://debian.org/security/2008/dsa-1467 · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?release_id=469627 · Correção
• http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?view=log · Nota
• http://secunia.com/advisories/28551 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6574 · Nota de Segurança
• http://bugs.mantisbugtracker.com/view.php?id=3375 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30870 · Nota
• http://secunia.com/advisories/23258 · Aviso do Fabricante
• http://bugs.mantisbugtracker.com/view.php?id=7364 · Nota
• http://securityfocus.com/bid/21566 · Nota
• http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?r1=1.34&r2=1.35 · Nota
• http://mantisbugtracker.com/changelog.php · Nota
• http://vupen.com/english/advisories/2006/4978 · Nota