Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) view_type and (2) target_field parameters.

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4238     Missing input sanitising allows remote attackers to     inject arbitrary web script or HTML.

  - CVE-2005-4518     Tobias Klein discovered that Mantis allows remote     attackers to bypass the file upload size restriction.

  - CVE-2005-4519     Tobias Klein discovered several SQL injection     vulnerabilities that allow remote attackers to execute     arbitrary SQL commands.

  - CVE-2005-4520     Tobias Klein discovered unspecified 'port injection'     vulnerabilities in filters.

  - CVE-2005-4521     Tobias Klein discovered a CRLF injection vulnerability     that allows remote attackers to modify HTTP headers and     conduct HTTP response splitting attacks.

  - CVE-2005-4522     Tobias Klein discovered several cross-site scripting     (XSS) vulnerabilities that allow remote attackers to     inject arbitrary web script or HTML.

  - CVE-2005-4523     Tobias Klein discovered that Mantis discloses private     bugs via public RSS feeds, which allows remote attackers     to obtain sensitive information.

  - CVE-2005-4524     Tobias Klein discovered that Mantis does not properly     handle 'Make note private' when a bug is being resolved,     which has unknown impact and attack vectors, probably     related to an information leak.

The old stable distribution (woody) does not seem to be affected by these problems.

The remote host is affected by the vulnerability described in GLSA-200512-12 (Mantis: Multiple vulnerabilities)

    Tobias Klein discovered that Mantis contains several vulnerabilities,     including:
    a file upload vulnerability.
    an injection vulnerability in filters.
    a SQL injection vulnerability in the user-management page.
    a port cross-site-scripting vulnerability in filters.
    an HTTP header CRLF injection vulnerability.
  Impact :

    An attacker could possibly exploit the file upload vulnerability to     execute arbitrary script code, and the SQL injection vulnerability to     access or modify sensitive information from the Mantis database.
    Furthermore, the cross-site scripting and HTTP response splitting may     allow an attacker to inject and execute malicious script code or to     steal cookie-based authentication credentials, potentially compromising     the victim's browser.
  Workaround :

    There is no known workaround at this time.

The remote host appears to be running a vulnerable version of Mantis, a bug tracker web application written in PHP. It is reported that versions 0.19.3 and lower are vulnerable to a number of flaws.  While the details of the flaws are unknown, it is believed that successful exploitation of the flaws would lead to an attacker uploading files or executing code on the remote database.

ID	Name	Product	Family	Severity
22810	Debian DSA-944-1 : mantis - several vulnerabilities	Nessus	Debian Local Security Checks	high
20353	GLSA-200512-12 : Mantis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
3335	Mantis < 0.19.5 Multiple Unspecified Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-4522

medium

Tenable Plugins

high

high

high