Detections
Analytics
Mantis < 0.17.5 Multiple Vulnerabilities
high Nessus Plugin ID 11653
Language:
Synopsis
The remote web server contains a PHP application that is affected by several flaws.Description
According to its banner, the version of Mantis on the remote host contains various flaws that may allow an attacker to execute arbitrary commands, inject SQL commands, view bugs it should not see, and get a list of projects that should be hidden.Solution
Upgrade to Mantis 0.17.5 or later.See Also
https://seclists.org/bugtraq/2002/Aug/272
https://seclists.org/bugtraq/2002/Aug/273
https://seclists.org/bugtraq/2002/Aug/280
https://seclists.org/bugtraq/2002/Aug/282
https://seclists.org/bugtraq/2002/Aug/283
Plugin Details
Severity: High
ID: 11653
File Name: mantis_multiple_vulns.nasl
Version: 1.28
Type: remote
Family: CGI abuses
Published: 5/27/2003
Updated: 4/11/2022
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.1
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:mantisbt:mantisbt
Required KB Items: Settings/ParanoidReport, installed_sw/MantisBT
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/13/2002
Reference Information
CVE: CVE-2002-1110, CVE-2002-1111, CVE-2002-1112, CVE-2002-1113, CVE-2002-1114, CVE-2002-1115, CVE-2002-1116