PT-2002-2113 · Mantis · Mantis

Published 2002-09-10 · Updated 2016-10-18 · CVE-2002-1110

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mantis versions 0.17.2 and earlier

Description: The issue allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, for example, to the "account update.php" endpoint, when running without magic quotes gpc enabled.

Recommendations: For Mantis versions 0.17.2 and earlier, consider disabling the account update functionality until a patch is available, and ensure magic quotes gpc is enabled to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1110

DSA-153

Affected Products

Mantis

References · 6

• http://debian.org/security/2002/dsa-153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1110 · Security Note
• http://securityfocus.com/bid/5510 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=102978728718851&w=2 · Note
• http://mantisbt.sourceforge.net/advisories/2002/2002-01.txt · Note
• http://iss.net/security_center/static/9897.php · Note