PT-2006-7176 · Mantis · Mantis

Published 2006-12-15 · Updated 2017-07-29 · CVE-2006-6574

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mantis versions prior to 1.1.0a2

Description The issue concerns the lack of per-item access control for Issue History (Bug History), allowing remote attackers to obtain sensitive information by reading the Change column. This can be demonstrated by accessing the Change column of a custom field.

Recommendations For versions prior to 1.1.0a2, update to version 1.1.0a2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2006-6574

DSA-1467-1

Affected Products

Mantis

References · 13

• http://debian.org/security/2008/dsa-1467 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=469627 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-6574 · Security Note
• http://secunia.com/advisories/23258 · Vendor Advisory
• http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?view=log · Note
• http://secunia.com/advisories/28551 · Note
• http://bugs.mantisbugtracker.com/view.php?id=3375 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30870 · Note
• http://bugs.mantisbugtracker.com/view.php?id=7364 · Note
• http://securityfocus.com/bid/21566 · Note
• http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?r1=1.34&r2=1.35 · Note
• http://mantisbugtracker.com/changelog.php · Note
• http://vupen.com/english/advisories/2006/4978 · Note