BID:31868

Mantis 'string_api.php' Issue Number Information Disclosure Vulnerability

Info

Mantis 'string_api.php' Issue Number Information Disclosure Vulnerability

Bugtraq ID:	31868
Class:	Access Validation Error
CVE:	CVE-2008-4688
Remote:	Yes
Local:	No
Published:	Oct 22 2008 12:00AM
Updated:	Dec 03 2008 08:31PM
Credit:	This vulnerability was disclosed by the vendor.
Vulnerable:	Mantis Mantis 1.1.2 Mantis Mantis 1.1.1 Mantis Mantis 1.1 Mantis Mantis 1.0.1 Mantis Mantis 1.0 .0RC4 Mantis Mantis 1.0 .0RC3 Mantis Mantis 1.0 .0rc2 Mantis Mantis 1.0 .0rc1 Mantis Mantis 1.0 .0a3 Mantis Mantis 1.0 .0a2 Mantis Mantis 1.0 .0a1 Mantis Mantis 1.0 Mantis Mantis 0.19.4 Mantis Mantis 0.19.3 Mantis Mantis 0.19.2 Mantis Mantis 0.19.1 Mantis Mantis 0.19 .0RC1 Mantis Mantis 0.19 .0a2 Mantis Mantis 0.19 .0a1 Mantis Mantis 0.19 .0a Mantis Mantis 0.19 .0 Mantis Mantis 0.18.3 Mantis Mantis 0.18.2 Mantis Mantis 0.18 a1 Mantis Mantis 0.18 0rc1 Mantis Mantis 0.18 0a4 Mantis Mantis 0.18 0a3 Mantis Mantis 0.18 0a2 Mantis Mantis 0.18 Mantis Mantis 0.17.5 Mantis Mantis 0.17.5 Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 Mantis Mantis 0.17.4 Mantis Mantis 0.17.3 Mantis Mantis 0.17.3 Mantis Mantis 0.17.2 Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Mantis Mantis 0.17.1 Mantis Mantis 0.17 .0 Mantis Mantis 0.17 Mantis Mantis 0.16.1 Mantis Mantis 0.16.1 Mantis Mantis 0.16 .0 Mantis Mantis 0.16 Mantis Mantis 0.15.12 Mantis Mantis 0.15.12 Mantis Mantis 0.15.11 Mantis Mantis 0.15.11 Mantis Mantis 0.15.10 Mantis Mantis 0.15.9 Mantis Mantis 0.15.9 Mantis Mantis 0.15.8 Mantis Mantis 0.15.8 Mantis Mantis 0.15.7 Mantis Mantis 0.15.7 Mantis Mantis 0.15.6 Mantis Mantis 0.15.6 Mantis Mantis 0.15.5 Mantis Mantis 0.15.5 Mantis Mantis 0.15.4 Mantis Mantis 0.15.4 Mantis Mantis 0.15.3 Mantis Mantis 0.15.3 Mantis Mantis 0.15.2 Mantis Mantis 0.15.1 Mantis Mantis 0.15 Mantis Mantis 0.14.8 Mantis Mantis 0.14.7 Mantis Mantis 0.14.6 Mantis Mantis 0.14.5 Mantis Mantis 0.14.4 Mantis Mantis 0.14.3 Mantis Mantis 0.14.2 Mantis Mantis 0.14.1 Mantis Mantis 0.14 Mantis Mantis 0.13.1 Mantis Mantis 0.13 Mantis Mantis 0.12 Mantis Mantis 0.11.1 Mantis Mantis 0.11 Mantis Mantis 0.10.2 Mantis Mantis 0.10.1 Mantis Mantis 0.10 Mantis Mantis 0.9.1 Mantis Mantis 0.9 Mantis Mantis 1.1.0a2 Mantis Mantis 1.0.0 RC5 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha

Not Vulnerable:	Mantis Mantis 1.1.4 Mantis Mantis 1.1.3

Discussion

Mantis 'string_api.php' Issue Number Information Disclosure Vulnerability

Mantis is prone to an information-disclosure vulnerability because the application fails to protect private information.

Attackers may exploit this issue to retrieve sensitive information that may aid in further attacks.

Versions prior to Mantis 1.1.3 are vulnerable.

Exploit / POC

Mantis 'string_api.php' Issue Number Information Disclosure Vulnerability

An attacker can exploit this issue through a browser.

Solution / Fix

Mantis 'string_api.php' Issue Number Information Disclosure Vulnerability

Solution:
The vendor released Mantis 1.1.3 to address this issue. Please see the references for more information.

Mantis Mantis 1.1.0a2