Detections
Analytics
Mantis < 0.18.3 / 0.19.0a2 Multiple Vulnerabilities
medium Nessus Plugin ID 14324
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple vulnerabilities.Description
According to its banner, the remote version of Mantis contains multiple flaws that may allow an attacker to use it to perform a mass emailing, to inject HTML tags in the remote pages, or to execute arbitrary commands on the remote host if PHP's 'register_globals' setting is enabled.Solution
Upgrade to Mantis 0.18.3 or 0.19.0a2 or later.See Also
Plugin Details
Severity: Medium
ID: 14324
File Name: mantis_multiple_vulns2.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 8/22/2004
Updated: 4/11/2022
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:mantisbt:mantisbt
Required KB Items: Settings/ParanoidReport, installed_sw/MantisBT
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/20/2004