Vulnerability CVE-2005-4523 - CERT Civis.Net

Vulnerability Name:

CVE-2005-4523 (CCN-24998)

Assigned:

2005-12-23

Published:

2005-12-23

Updated:

2011-03-08

Summary:

Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2005-4523

Source: CCN
Type: SA18181
Mantis Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
18181

Source: SECUNIA
Type: Vendor Advisory
18221

Source: SECUNIA
Type: UNKNOWN
18481

Source: CCN
Type: SourceForge.net: Files
Mantis

Source: CONFIRM
Type: UNKNOWN
http://sourceforge.net/project/shownotes.php?release_id=377934&group_id=14963

Source: DEBIAN
Type: UNKNOWN
DSA-944

Source: DEBIAN
Type: DSA-944
mantis -- several vulnerabilities

Source: CCN
Type: Mantis Bug Tracker Web page
Download Mantis 1.0.1

Source: CCN
Type: OSVDB ID: 22057
Mantis Public RSS Feed Private Bug Disclosure

Source: CCN
Type: BID-16046
Mantis Multiple Unspecified Remote Vulnerabilities

Source: MISC
Type: Exploit, Vendor Advisory
http://www.trapkit.de/advisories/TKADV2005-11-002.txt

Source: VUPEN
Type: UNKNOWN
ADV-2005-3064

Source: XF
Type: UNKNOWN
mantis-rssfeed-disclose-information(24998)

Vulnerable Configuration:

Configuration 1:

cpe:/a:mantis:mantis:0.9:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.9.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.10:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.10.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.10.2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.11:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.11.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.12:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.13:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.13.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.3:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.4:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.5:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.6:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.7:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.14.8:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.3:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.4:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.5:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.6:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.7:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.8:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.9:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.10:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.11:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.15.12:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.16:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.16.0:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.16.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.0:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.3:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.4:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.4a:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.17.5:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18.0_rc1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18.0a2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18.0a3:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18.0a4:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18.2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18.3:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.18a1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.0:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.0_rc1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.0a:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.0a1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.0a2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:0.19.3:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:1.0.0_rc1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:1.0.0_rc2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:*:*:*:*:*:*:*:* (Version <= 1.0.0_rc3)

OR cpe:/a:mantis:mantis:1.0.0a1:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:1.0.0a2:*:*:*:*:*:*:*

OR cpe:/a:mantis:mantis:1.0.0a3:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.debian:def:944	V	several vulnerabilities	2006-01-17