fkie_cve-2010-4349
Vulnerability from fkie_nvd
Published
2011-01-03 20:00
Modified
2024-11-21 01:20
Severity ?
Summary
admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
References
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/052721.html
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/052730.html
secalert@redhat.comhttp://openwall.com/lists/oss-security/2010/12/15/4Exploit, Patch
secalert@redhat.comhttp://openwall.com/lists/oss-security/2010/12/16/1Exploit, Patch
secalert@redhat.comhttp://secunia.com/advisories/42772
secalert@redhat.comhttp://secunia.com/advisories/51199
secalert@redhat.comhttp://security.gentoo.org/glsa/glsa-201211-01.xml
secalert@redhat.comhttp://www.mantisbt.org/blog/?p=123
secalert@redhat.comhttp://www.mantisbt.org/bugs/changelog_page.php?version_id=112
secalert@redhat.comhttp://www.mantisbt.org/bugs/view.php?id=12607
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/0002
secalert@redhat.comhttp://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.phpExploit, Patch
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=663230Exploit, Patch
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/64463
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052721.html
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052730.html
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2010/12/15/4Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2010/12/16/1Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42772
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51199
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201211-01.xml
af854a3a-2127-422b-91ae-364da2661108http://www.mantisbt.org/blog/?p=123
af854a3a-2127-422b-91ae-364da2661108http://www.mantisbt.org/bugs/changelog_page.php?version_id=112
af854a3a-2127-422b-91ae-364da2661108http://www.mantisbt.org/bugs/view.php?id=12607
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0002
af854a3a-2127-422b-91ae-364da2661108http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.phpExploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=663230Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/64463
Impacted products
Vendor Product Version
mantisbt mantisbt *
mantisbt mantisbt 0.18.0
mantisbt mantisbt 0.19.0
mantisbt mantisbt 0.19.0
mantisbt mantisbt 0.19.0a1
mantisbt mantisbt 0.19.0a2
mantisbt mantisbt 0.19.1
mantisbt mantisbt 0.19.2
mantisbt mantisbt 0.19.3
mantisbt mantisbt 0.19.4
mantisbt mantisbt 0.19.5
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.0a1
mantisbt mantisbt 1.0.0a2
mantisbt mantisbt 1.0.0a3
mantisbt mantisbt 1.0.1
mantisbt mantisbt 1.0.2
mantisbt mantisbt 1.0.3
mantisbt mantisbt 1.0.4
mantisbt mantisbt 1.0.5
mantisbt mantisbt 1.0.6
mantisbt mantisbt 1.0.7
mantisbt mantisbt 1.0.8
mantisbt mantisbt 1.1.0
mantisbt mantisbt 1.1.1
mantisbt mantisbt 1.1.2
mantisbt mantisbt 1.1.4
mantisbt mantisbt 1.1.5
mantisbt mantisbt 1.1.6
mantisbt mantisbt 1.1.7
mantisbt mantisbt 1.1.8
mantisbt mantisbt 1.2.0
mantisbt mantisbt 1.2.1
mantisbt mantisbt 1.2.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB90875A-388F-493C-8076-F59EA12F9355",
              "versionEndIncluding": "1.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.18.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF83F757-4B62-441C-8421-15809E573A83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A608AFEC-B265-4143-99DA-BB2AE9D522BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "7FCB56AC-4C14-49B1-BEFE-8651BC70476E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.0a1:*:*:*:*:*:*:*",
              "matchCriteriaId": "64BCCC4D-D109-4116-A9C3-E5553686A986",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.0a2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAAF1C66-9DC7-4FD3-8651-C5561B2681A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F59BAE6B-C73D-4BE2-AEF9-93F2F4A4373F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9DA5C2F-FB7C-4D95-81DE-24D8EADC5C30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "85A3FBD5-163C-4990-B809-A5C9C81A3C6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3FDF456-9648-4A7C-B15A-2828A32D4962",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:0.19.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EE8BCBE-D864-4311-B73A-DF92162D8DF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B2602F7-2D93-4E1E-9425-4EDD23752029",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "62F6B391-DDE3-4E8E-8582-85EA7287E591",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "80DBD667-1FB9-4354-9150-A190D4D817A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "F27E40C0-263F-452B-8C91-E621A02EFC28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "CB888B14-EA67-4EDB-A3AF-ACD3F0A6227E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "1DB45A02-2522-4E10-BC81-48750ACB42DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0a1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC837ACF-EB55-4E9C-BFC5-83BB04B84BE3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0a2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8826523-FDEE-4C14-8EAC-97C564272CC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.0a3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1780295B-215F-4EEE-8CF8-2E3531D7A196",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "86DE3BE3-D6C9-4905-9E61-B70776460604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F128A2E2-D509-4B50-95C2-1A31C5B3B31F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "140D5F68-1CAB-458C-BC8B-4F726D657FE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D25F4F5-7678-41C1-93CB-305883A08527",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1A1316D-314B-4740-A836-D5E6319F4B28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBD27CCE-28C4-43CC-8CBD-D7FFB46171AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "97298C43-B881-4C11-ADB6-17A8E43EB84E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "7257ADD7-C9B7-4F85-AA13-615DD033FD5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "02FE950B-5E29-4FAA-9BE5-79F38B4C38F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6F2BA78-D054-4E49-ABCA-637922898BF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4595B1E3-25AB-489E-A847-FDBF2554DD6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11A8F17-5253-475B-89FF-A26EA7531E13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A88B09D-CDCF-45FD-B004-13B597DA4F48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "49583BE8-B832-4E9F-B154-47A26C72489D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2501F40-3630-4528-BE0A-61D4BB6EC7FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "9223DAF7-D03E-4A4E-8AB5-5CEB87DFF2C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFF77ABF-0A03-437A-B241-1EF2BBB83D24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F096CD6-534E-4ABF-B2DF-D4B55B8C5F6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A66AB537-6FBA-4A51-B10C-BF61F54BC01B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP."
    },
    {
      "lang": "es",
      "value": "admin / upgrade_unattended.php en MantisBT anterior a v1.2.4 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de un par\u00e1metro db_type no v\u00e1lido, lo cual revela la ruta de instalaci\u00f3n en un mensaje de error, relacionado con una llamada insegura por MantisBT a una funci\u00f3n en la Biblioteca ADOdb para PHP ."
    }
  ],
  "id": "CVE-2010-4349",
  "lastModified": "2024-11-21T01:20:45.230",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-01-03T20:00:43.013",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052721.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052730.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2010/12/15/4"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2010/12/16/1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/42772"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/51199"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://security.gentoo.org/glsa/glsa-201211-01.xml"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mantisbt.org/blog/?p=123"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mantisbt.org/bugs/changelog_page.php?version_id=112"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mantisbt.org/bugs/view.php?id=12607"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2011/0002"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.php"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=663230"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64463"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052721.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052730.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2010/12/15/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2010/12/16/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/42772"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/51199"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201211-01.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mantisbt.org/blog/?p=123"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mantisbt.org/bugs/changelog_page.php?version_id=112"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mantisbt.org/bugs/view.php?id=12607"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0002"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=663230"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64463"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.