Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php.

The remote host is affected by the vulnerability described in GLSA-201211-01 (MantisBT: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MantisBT. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to conduct       directory traversal attacks, disclose the contents of local files, inject       arbitrary web scripts, obtain sensitive information, bypass       authentication and intended access restrictions, or manipulate bugs and       attachments.
  Workaround :

    There is no known workaround at this time.

- Mon Sep 20 2010 Gianluca Sforna <giallu at gmail.com> -     1.1.8-4

    - Fix CVE-2010-3070 using system's NuSOAP (#633011)

    - Fix CVE-2010-2574 and CVE-2010-3303 (#633003 #634340)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Sep 20 2010 Gianluca Sforna <giallu at gmail.com> -     1.1.8-4

    - Fix CVE-2010-3070 using system's NuSOAP (#633011)

    - Fix CVE-2010-2574 and CVE-2010-3303 (#633003 #634340)

    - Sun Jan 17 2010 Gianluca Sforna <giallu gmail com> -       1.1.8-3

    - Tweak summary

    - Don't restart apache (#552943)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #633011 - Mantis: Vulnerable to CVE-2010-3070 (XSS     in php-nusoap) due use of embedded copy of nusoap     library

  - Bug #634340 - CVE-2010-3303 mantis: several XSS flaws     fixed in 1.2.3

  - Bug #633003 - CVE-2010-2574 Mantis: XSS in Add Category     action.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is hosting Mantis, an open source bugtracking application written in PHP.

Versions of Mantis 1.2.x prior to 1.2.3 are potentially affected by multiple cross-site scripting vulnerabilities :

  - A cross-site scripting issue exists when viewing the Summary page. (Bug 0012309)

  - A cross-site scripting issue exists in print_all_bug_page_word.php when printing project and category names. (Bug 0012238)

  - Multiple cross-site scripting issues exist which relate to custom field enumeration values. (Bug 0012232)

  - A cross-site scripting vulnerability exists when deleting maliciously named categories. (Bug 012230)

  - A cross-site scripting issue exists in NuSOAP WSDL. (Bug 0012312)

ID	Name	Product	Family	Severity
62867	GLSA-201211-01 : MantisBT: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
49725	Fedora 13 : mantis-1.1.8-4.fc13 (2010-15082)	Nessus	Fedora Local Security Checks	medium
49724	Fedora 12 : mantis-1.1.8-4.fc12 (2010-15080)	Nessus	Fedora Local Security Checks	medium
49723	Fedora 14 : mantis-1.1.8-4.fc14 (2010-15061)	Nessus	Fedora Local Security Checks	medium
5676	Mantis 1.2.x < 1.2.3 Cross-Site Scripting Vulnerability	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2010-3303

medium

Tenable Plugins

high

medium

medium

medium

medium