Cross-site scripting (XSS) vulnerability in bug_actiongroup_page.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the summary of the bug, which is not quoted when view_all_bug_page.php is used to delete the bug, as identified by bug#0006002, a different vulnerability than CVE-2005-2557.

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3091     A cross-site scripting vulnerability allows attackers to     inject arbitrary web script or HTML.

  - CVE-2005-3335     A file inclusion vulnerability allows remote attackers     to execute arbitrary PHP code and include arbitrary     local files.

  - CVE-2005-3336     A SQL injection vulnerability allows remote attackers to     execute arbitrary SQL commands.

  - CVE-2005-3338     Mantis can be tricked into displaying the otherwise     hidden real mail address of its users.

Two security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2556     A remote attacker could supply a specially crafted URL     to scan arbitrary ports on arbitrary hosts that may not     be accessible otherwise.

  - CAN-2005-2557

    A remote attacker was able to insert arbitrary HTML code     in bug reports, hence, cross site scripting.

  - CAN-2005-3090

    A remote attacker was able to insert arbitrary HTML code     in bug reports, hence, cross site scripting.

The old stable distribution (woody) does not seem to be affected by these problems.

According to its banner, the version of Mantis on the remote host fails to sanitize user-supplied input to the 'g_db_type' parameter of the 'core/database_api.php' script.  Provided PHP's 'register_globals' setting is enabled, an attacker may be able to exploit this to connect to arbitrary databases as well as scan for arbitrary open ports, even on an internal network.  In addition, it is reportedly prone to multiple cross-site scripting issues.

ID	Name	Product	Family	Severity
22771	Debian DSA-905-1 : mantis - several vulnerabilities	Nessus	Debian Local Security Checks	high
19475	Debian DSA-778-1 : mantis - missing input sanitising	Nessus	Debian Local Security Checks	high
19473	Mantis < 1.0.0rc2 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2005-3090

medium

Tenable Plugins

high

high

medium