Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the target_field parameter.

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4238     Missing input sanitising allows remote attackers to     inject arbitrary web script or HTML.

  - CVE-2005-4518     Tobias Klein discovered that Mantis allows remote     attackers to bypass the file upload size restriction.

  - CVE-2005-4519     Tobias Klein discovered several SQL injection     vulnerabilities that allow remote attackers to execute     arbitrary SQL commands.

  - CVE-2005-4520     Tobias Klein discovered unspecified 'port injection'     vulnerabilities in filters.

  - CVE-2005-4521     Tobias Klein discovered a CRLF injection vulnerability     that allows remote attackers to modify HTTP headers and     conduct HTTP response splitting attacks.

  - CVE-2005-4522     Tobias Klein discovered several cross-site scripting     (XSS) vulnerabilities that allow remote attackers to     inject arbitrary web script or HTML.

  - CVE-2005-4523     Tobias Klein discovered that Mantis discloses private     bugs via public RSS feeds, which allows remote attackers     to obtain sensitive information.

  - CVE-2005-4524     Tobias Klein discovered that Mantis does not properly     handle 'Make note private' when a bug is being resolved,     which has unknown impact and attack vectors, probably     related to an information leak.

The old stable distribution (woody) does not seem to be affected by these problems.

r0t reports :

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to 'target_field' parameter in 'view_filters_page.php' isn't properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

r0t reports :

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to 'target_field' parameter in 'view_filters_page.php' is not properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

ID	Name	Product	Family	Severity
22810	Debian DSA-944-1 : mantis - several vulnerabilities	Nessus	Debian Local Security Checks	high
21450	FreeBSD : mantis -- 'view_filters_page.php' XSS vulnerability (6e3b12e2-6ce3-11da-b90c-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
21430	FreeBSD : mantis -- 'view_filters_page.php' XSS vulnerability (592815da-9eed-11da-b410-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2005-4238

medium

Tenable Plugins

high

medium

medium