Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.

The installation of MantisBT on the remote host includes a version of NuSOAP that fails to sanitize user input passed via PHP's $_SERVER['PHP_SELF'] variable to 'nusoap/nusoap.php' via 'soap/mantisconnect.php' before using it to generate dynamic HTML content.

An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

Although Nessus has not checked for them, the installed version is also likely to be affected by several other cross-site scripting vulnerabilities.

- Mon Sep 20 2010 Gianluca Sforna <giallu at gmail.com> -     1.1.8-4

    - Fix CVE-2010-3070 using system's NuSOAP (#633011)

    - Fix CVE-2010-2574 and CVE-2010-3303 (#633003 #634340)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Sep 20 2010 Gianluca Sforna <giallu at gmail.com> -     1.1.8-4

    - Fix CVE-2010-3070 using system's NuSOAP (#633011)

    - Fix CVE-2010-2574 and CVE-2010-3303 (#633003 #634340)

    - Sun Jan 17 2010 Gianluca Sforna <giallu gmail com> -       1.1.8-3

    - Tweak summary

    - Don't restart apache (#552943)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #633011 - Mantis: Vulnerable to CVE-2010-3070 (XSS     in php-nusoap) due use of embedded copy of nusoap     library

  - Bug #634340 - CVE-2010-3303 mantis: several XSS flaws     fixed in 1.2.3

  - Bug #633003 - CVE-2010-2574 Mantis: XSS in Add Category     action.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is hosting Mantis, an open source bugtracking application written in PHP.

Versions of Mantis 1.2.x prior to 1.2.3 are potentially affected by multiple cross-site scripting vulnerabilities :

  - A cross-site scripting issue exists when viewing the Summary page. (Bug 0012309)

  - A cross-site scripting issue exists in print_all_bug_page_word.php when printing project and category names. (Bug 0012238)

  - Multiple cross-site scripting issues exist which relate to custom field enumeration values. (Bug 0012232)

  - A cross-site scripting vulnerability exists when deleting maliciously named categories. (Bug 012230)

  - A cross-site scripting issue exists in NuSOAP WSDL. (Bug 0012312)

fixes XSS vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
49792	MantisBT nusoap/nusoap.php NuSOAP WSDL XSS	Nessus	CGI abuses : XSS	medium
49725	Fedora 13 : mantis-1.1.8-4.fc13 (2010-15082)	Nessus	Fedora Local Security Checks	medium
49724	Fedora 12 : mantis-1.1.8-4.fc12 (2010-15080)	Nessus	Fedora Local Security Checks	medium
49723	Fedora 14 : mantis-1.1.8-4.fc14 (2010-15061)	Nessus	Fedora Local Security Checks	medium
5676	Mantis 1.2.x < 1.2.3 Cross-Site Scripting Vulnerability	Nessus Network Monitor	CGI	medium
49680	Fedora 13 : php-nusoap-0.9.5-1.fc13 (2010-14100)	Nessus	Fedora Local Security Checks	medium
49679	Fedora 12 : php-nusoap-0.9.5-1.fc12 (2010-14098)	Nessus	Fedora Local Security Checks	medium
49678	Fedora 14 : php-nusoap-0.9.5-1.fc14 (2010-14058)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-3070

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium