PT-2008-5900 · Mantis · Mantis

Christian Hoffmann · Published 2008-10-22 · Updated 2009-02-10 · CVE-2008-4688

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mantis versions prior to 1.1.3

Description The issue concerns a lack of privilege checking in the composition of links with issue data. This allows remote attackers to discover sensitive information, such as an issue's title and status, by modifying the issue number in a request.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4688

Affected Products

Mantis

References · 9

• http://gentoo.org/security/en/glsa/glsa-200812-07.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4688 · Security Note
• http://mantisbt.org/bugs/view.php?id=9321 · Note
• http://openwall.com/lists/oss-security/2008/10/20/1 · Note
• http://mantisbt.org/bugs/changelog_page.php · Note
• http://secunia.com/advisories/32975 · Note
• http://securityfocus.com/bid/31868 · Note
• http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384 · Note
• http://secunia.com/advisories/32243 · Note