PT-2008-3768 · Mantis · Mantis

Antonio Parata + 1 · Publicado 2008-05-16 · Atualizado 2017-09-29 · CVE-2008-2276

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mantis version 1.1.1

Description: A cross-site request forgery issue exists, allowing remote attackers to create new administrative users via a crafted link. This is related to the manage user create.php file.

Recommendations: For Mantis version 1.1.1, update to a version that includes a fix for this issue to prevent exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-2276

Produtos afetados

Mantis

Referências · 13

• 🔥 https://exploit-db.com/exploits/5657 · Exploit
• http://securityfocus.com/bid/29297 · Nota
• http://secunia.com/advisories/30270 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=121130774617956&w=4 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00801.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2276 · Nota de Segurança
• http://vupen.com/english/advisories/2008/1598/references · Nota
• http://gentoo.org/security/en/glsa/glsa-200809-10.xml · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?group_id=14963&release_id=595025 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00813.html · Aviso do Fabricante
• http://secunia.com/advisories/31972 · Nota
• http://secunia.com/advisories/31171 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42447 · Nota