mantis vulnerabilities and fixes

Recent CVEs affecting mantis, with upgrade or downgrade steps. 45 tracked.

mantis has 45 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2019-12-17. Highest priority: CVE-2008-4687 (score 61/100).

• CVE-2019-16569 MEDIUM 4.3 UPGRADE A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to conne
• CVE-2008-4689 HIGH 7.5 UPGRADE Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attacker
• CVE-2008-4688 MEDIUM 5.0 UPGRADE core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link
• CVE-2008-4687 HIGH 9.0 UPGRADE manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a
• CVE-2008-3333 HIGH 7.5 UPGRADE Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to inclu
• CVE-2008-3332 MEDIUM 6.5 UPGRADE Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administ
• CVE-2008-3331 LOW 3.5 UPGRADE Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote at
• CVE-2008-2276 MEDIUM 6.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attack
• CVE-2008-0404 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary we
• CVE-2007-6611 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject
• CVE-2006-6574 MEDIUM 5.0 UPGRADE Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows
• CVE-2006-6515 HIGH 10.0 UPGRADE Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more priv
• CVE-2006-1577 MEDIUM 6.8 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier
• CVE-2006-0841 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to in
• CVE-2006-0840 MEDIUM 5.0 UPGRADE manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (q
• CVE-2006-0665 HIGH 10.0 DOWNGRADE Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unk
• CVE-2006-0664 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attacke
• CVE-2006-0147 HIGH 7.5 DOWNGRADE DOWNGRADE Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in
• CVE-2006-0146 HIGH 7.5 DOWNGRADE DOWNGRADE The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2
• CVE-2005-4523 MEDIUM 5.0 UPGRADE Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obta
• CVE-2005-4522 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.
• CVE-2005-4520 MEDIUM 5.0 DOWNGRADE Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and
• CVE-2005-4519 HIGH 7.5 UPGRADE Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and e
• CVE-2005-4238 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote
• CVE-2005-3339 HIGH 7.2 DOWNGRADE Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.
• CVE-2005-3338 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real ema
• CVE-2005-3337 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject a
• CVE-2005-3336 HIGH 7.5 DOWNGRADE SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL com
• CVE-2005-3335 HIGH 7.5 DOWNGRADE PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows rem
• CVE-2005-3091 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in Mantis before 1.0.0rc1 allows remote attackers to inject arbitrary
• CVE-2005-3090 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in bug_actiongroup_page.php in Mantis 0.19.0a1 through 1.0.0a3 allows
• CVE-2005-2557 MEDIUM 4.3 DOWNGRADE MITIGATE Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote
• CVE-2005-2556 HIGH 7.5 DOWNGRADE core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attacke
• CVE-2004-2666 MEDIUM 5.0 DOWNGRADE Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view
• CVE-2004-1734 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP cod
• CVE-2004-1731 MEDIUM 5.0 DOWNGRADE signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users a
• CVE-2004-1730 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web
• CVE-2003-0499 LOW 3.6 DOWNGRADE Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, wh
• CVE-2002-1116 HIGH 7.5 DOWNGRADE The "View Bugs" page (view_all_bug_page.php) in Mantis 0.17.4a and earlier includes summaries of private bugs
• CVE-2002-1115 MEDIUM 5.0 DOWNGRADE Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter
• CVE-2002-1114 HIGH 7.5 DOWNGRADE config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary fi
• CVE-2002-1113 HIGH 7.5 DOWNGRADE summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code
• CVE-2002-1112 MEDIUM 5.0 DOWNGRADE Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cook
• CVE-2002-1111 MEDIUM 5.0 DOWNGRADE print_all_bug_page.php in Mantis 0.17.3 and earlier does not verify the limit_reporters option, which allows r
• CVE-2002-1110 HIGH 10.0 DOWNGRADE Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc ena

FAQ

How do I fix mantis vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mantis being exploited right now?

None of the tracked mantis CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mantis CVE should I patch first?

CVE-2008-4687 currently ranks highest (61/100): manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a .

RSS feed for mantis · ← Back to latest CVEs