PT-2008-3768 · Mantis · Mantis

Antonio Parata + 1 · Published 2008-05-16 · Updated 2017-09-29 · CVE-2008-2276

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mantis version 1.1.1

Description: A cross-site request forgery issue exists, allowing remote attackers to create new administrative users via a crafted link. This is related to the manage user create.php file.

Recommendations: For Mantis version 1.1.1, update to a version that includes a fix for this issue to prevent exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-2276

Affected Products

Mantis

References · 13

• 🔥 https://exploit-db.com/exploits/5657 · Exploit
• http://secunia.com/advisories/30270 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00801.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2276 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200809-10.xml · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00813.html · Vendor Advisory
• http://securityfocus.com/bid/29297 · Note
• http://marc.info/?l=bugtraq&m=121130774617956&w=4 · Note
• http://vupen.com/english/advisories/2008/1598/references · Note
• http://sourceforge.net/project/shownotes.php?group_id=14963&release_id=595025 · Note
• http://secunia.com/advisories/31972 · Note
• http://secunia.com/advisories/31171 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42447 · Note