Info

Disclosure

Oct 11, 2005

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Mantis contains a flaw that may allow a remote attacker to carry out an SQL injection attack. No further details have been provided.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 0.19.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Kenzaburo Ito

Mantis

0.19.2

References

Secunia Advisory ID: 17654
CVE ID: 2005-3336 (see also: NVD)
Vendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?release_id=362673
Vendor Specific Advisory URL: http://www.debian.org/security/2005/dsa-905
http://www.gentoo.org/security/en/glsa/glsa-200510-24.xml
Vendor URL: http://www.mantisbt.org/

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218