Bug 233336 – www-apps/mantisbt <1.1.2 Multiple vulnerabilities (CVE-2008-{3331,3332,3333})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Robert Buchholz (RETIRED) 2008-07-30 00:41:02 UTC]

CVE-2008-3331 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3331):
  Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in
  Mantis before 1.1.2 allows remote attackers to inject arbitrary web script or
  HTML via the filter_target parameter.

[Comment 1 Robert Buchholz (RETIRED) 2008-07-30 00:44:41 UTC]

CVE-2008-3332 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3332):
  Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2
  allows remote authenticated administrators to execute arbitrary code via the
  value parameter.

CVE-2008-3333 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3333):
  Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2
  allows remote attackers to read and include arbitrary files via the language
  parameter to the user preferences page (account_prefs_update.php).

[Comment 2 Gunnar Wrobel (RETIRED) 2008-09-07 17:38:00 UTC]

1.1.2 seems to be in the tree so I'm removing webapps from cc. Please readd if webapps should still take an interest in the bug.

[Comment 3 Pierre-Yves Rofes (RETIRED) 2008-09-07 17:44:23 UTC]

Arches, please test and mark stable www-apps/mantisbt-1.1.2.
Target Keywords: "amd64 ppc x86"

[Comment 4 Markus Meier 2008-09-07 19:03:47 UTC]

amd64/x86 stable

[Comment 5 Tobias Scherbaum (RETIRED) 2008-09-19 18:48:45 UTC]

ppc stable

[Comment 6 Pierre-Yves Rofes (RETIRED) 2008-09-19 19:55:52 UTC]

glsa request filed.

[Comment 7 Pierre-Yves Rofes (RETIRED) 2008-09-21 17:28:15 UTC]

GLSA 200809-10