Mantis < 0.19.1 Multiple Information Disclosure Vulnerabilities

medium Nessus Network Monitor Plugin ID 2394

Synopsis

The remote host may give an attacker information useful for future attacks.

Description

The remote host appears to be running a vulnerable version of Mantis, a bug tracker web application written in PHP. It is reported that versions up to 0.19.0 are prone to multiple information disclosure vulnerabilities flaws that may allow an attacker to view stats of all projects or receive information from a project he was removed.

Solution

Upgrade to Mantis version 0.19.1 or higher.

Plugin Details

Severity: Medium

ID: 2394

Family: CGI

Published: 11/9/2004

Updated: 3/6/2019

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Reference Information

BID: 11622