Mantis < 0.19.1 Multiple Information Disclosure Vulnerabilities

Medium Nessus Network Monitor Plugin ID 2394

Synopsis

The remote host may give an attacker information useful for future attacks.

Description

The remote host appears to be running a vulnerable version of Mantis, a bug tracker web application written in PHP. It is reported that versions up to 0.19.0 are prone to multiple information disclosure vulnerabilities flaws that may allow an attacker to view stats of all projects or receive information from a project he was removed.

Solution

Upgrade to Mantis version 0.19.1 or higher.

Plugin Details

Severity: Medium

ID: 2394

Family: CGI

Published: 2004/11/09

Modified: 2016/01/21

Dependencies: 1442

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:H/RL:O/RC:C

Reference Information

BID: 11622