NVD

Id
4502  
Name
CVE-2008-4688  
Description
core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue"s title and status via a request with a modified issue number.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-10-22  
Modified Date
2009-02-10  
Seq
2008-4688  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
28339 4502 CVE-2008-4688 http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384  View
28340 4502 CVE-2008-4688 GLSA-200812-07  View
28341 4502 CVE-2008-4688 http://www.mantisbt.org/bugs/changelog_page.php  View
28342 4502 CVE-2008-4688 http://www.mantisbt.org/bugs/view.php?id=9321  View
28343 4502 CVE-2008-4688 [oss-security] 20081020 Re: CVE request: mantisbt < 1.1.4: RCE  View
28344 4502 CVE-2008-4688 31868  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47098 JVNDB-2008-002408 Mantis の core/string_api.php における不正に issue 情報を取得される脆弱性 Mantis の core/string_api.php には、元データ末尾の issue 情報とのリンク構成前に閲覧者の権限を確認しないため、不正に issue 情報を取得される脆弱性が存在します。 CVE-2008-4688 34801 CVE-2008-4688 4502 5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002408.html 2008-10-22 2009-07-08 View