The remote host is affected by the vulnerability described in GLSA-200809-10 (Mantis: Multiple vulnerabilities)

    Antonio Parata and Francesco Ongaro reported a Cross-Site Request     Forgery vulnerability in manage_user_create.php (CVE-2008-2276), a     Cross-Site Scripting vulnerability in return_dynamic_filters.php     (CVE-2008-3331), and an insufficient input validation in     adm_config_set.php (CVE-2008-3332). A directory traversal vulnerability     in core/lang_api.php (CVE-2008-3333) has also been reported.
  Impact :

    A remote attacker could exploit these vulnerabilities to execute     arbitrary HTML and script code, create arbitrary users with     administrative privileges, execute arbitrary PHP commands, and include     arbitrary files.
  Workaround :

    There is no known workaround at this time.

Update to upstream version 1.1.2, fixing following security issues: - 0008974: XSS Vulnerability in filters - 0008975: CSRF Vulnerabilities in user_create (CVE-2008-2276) - 0008976: Remote Code Execution in adm_config - 0009154: arbitrary file inclusion through user preferences page See upstream changelog for details on all bugs fixed in new upstream version:
http://www.mantisbt.org/bugs/changelog_page.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

リモートホストにインストールされているMantis Bug Trackerのバージョンは、さまざまな管理アクションを実行する前に、HTTPリクエストの妥当性を検証しません。リモート攻撃者が特別に細工されたページを表示するようにログインしている管理者を騙せる場合は、この脆弱性を利用して、管理者権限を持つ追加のユーザーを作成するなど、影響を受けるアプリケーションに対してクロスサイトリクエストフォージェリ攻撃を仕掛ける可能性があります。 

このアプリケーションは、攻撃者が管理者権限を持っている場合にリモートコード実行を可能にするなどの他の問題の影響も受けることが報告されていますが、Nessusではそれらを明示的にテストしていないことに注意してください。

Secunia reports :

Some vulnerabilities have been reported in Mantis, which can be exploited by malicious users to compromise a vulnerable system and malicious people to conduct cross-site scripting and request forgery attacks.

Input passed to the 'filter_target' parameter in return_dynamic_filters.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

A vulnerability is caused due to the application allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g.
add a new user with administrative privileges by enticing a logged-in administrator to visit a malicious site.

Input passed to the 'value' parameter in adm_config_set.php is not properly sanitised before being used in an 'eval()' statement. This can be exploited to e.g. execute arbitrary PHP commands via a specially crafted request.

Input passed to the 'language' parameter in account_prefs_update.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

遠端主機上安裝的 Mantis Bug Tracker 版本在執行各種管理動作之前，不會驗證 HTTP 要求的有效性。如果遠端攻擊者可誘騙已登入的系統管理員檢視特製頁面，便可利用此弱點對受影響應用程式發動跨網站要求偽造攻擊，例如建立具有系統管理員權限的其他使用者。 

請注意，據報該應用程式也受到其他問題影響，包括一個允許遠端程式碼執行的問題，前提是攻擊者具有系統管理員權限，但 Nessus 並未明確測試過這些問題。

The version of Mantis Bug Tracker installed on the remote host does not verify the validity of HTTP requests before performing various administrative actions.  If a remote attacker can trick a logged-in administrator into viewing a specially crafted page, the vulnerability could be leveraged to launch cross-site request forgery attacks against the affected application, such as creating additional users with administrator privileges. 

Note that the application is also reportedly affected by other issues, including one that allows remote code execution provided an attacker has administrator privileges, although Nessus did not explicitly test for them.

The version of Mantis Bug Tracker installed on the remote host does not verify the validity of HTTP requests before performing various administrative actions.  If a remote attacker can trick a logged-in administrator into viewing a specially-crafted page, he can leverage this issue to launch cross-site request forgery attacks against the affected application, such as creating additional users with administrator privileges.

ID	名稱	產品	系列	已發布	已更新	嚴重性
34250	GLSA-200809-10 : Mantis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2008/9/22	2021/1/6	high
33554	Fedora 9 : mantis-1.1.2-1.fc9 (2008-6647)	Nessus	Fedora Local Security Checks	2008/7/23	2021/1/11	medium
32324	Mantis managed_user_create.php CSRFの新しいユーザーの作成	Nessus	CGI abuses	2008/5/15	2022/4/11	medium
35052	FreeBSD : mantis -- multiple vulnerabilities (29255141-c3df-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	2008/12/8	2021/1/6	high
32324	Mantis Manage_user_create.php CSRF 新使用者建立	Nessus	CGI abuses	2008/5/15	2022/4/11	medium
32324	Mantis manage_user_create.php CSRF New User Creation	Nessus	CGI abuses	2008/5/15	2022/4/11	medium
33555	Fedora 8 : mantis-1.1.2-1.fc8 (2008-6657)	Nessus	Fedora Local Security Checks	2008/7/23	2021/1/11	medium
4506	Mantis Cross-Site Request Forgery Vulnerabilities	Nessus Network Monitor	CGI	2004/8/18	2019/3/6	medium

偵測

搜尋 Plugin

high

medium

medium

high

medium

medium

medium

medium