Follow @discotekdotca
CVE-2005-2557
Current Description
Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.
| Referenced by CVEs: | CVE-2005-3090 |
Basic Data
| Published | September 28, 2005 |
|---|---|
| Last Modified | July 11, 2017 |
| Assigner | cve@mitre.org |
| Data Type | CVE |
| Data Format | MITRE |
| Data Version | 4.0 |
| Problem Type | NVD-CWE-Other |
| CVE Data Version | 4.0 |
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|---|
| CVSS 2 - Vector String | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| CVSS 2 - Access Vector | NETWORK |
| CVSS 2 - Access Complexity | MEDIUM |
| CVSS 2 - Authentication | NONE |
| CVSS 2 - Confidentiality Impact | NONE |
| CVSS 2 - Availability Impact | NONE |
| CVSS 2 - Base Score | 4.3 |
| Severity | MEDIUM |
| Exploitability Score | 8.6 |
| Impact Score | 2.9 |
| Obtain All Privilege | false |
| Obtain User Privilege | false |
| Obtain Other Privilege | false |
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 Application Mantis Mantis 0.19.0 * * * * * * * 2.3 Application Mantis Mantis 0.19.0_rc1 * * * * * * * 2.3 Application Mantis Mantis 0.19.0a1 * * * * * * * 2.3 Application Mantis Mantis 0.19.0a2 * * * * * * * 2.3 Application Mantis Mantis 0.19.1 * * * * * * * 2.3 Application Mantis Mantis 0.19.2 * * * * * * * 2.3 Application Mantis Mantis 1.0.0a1 * * * * * * * 2.3 Application Mantis Mantis 1.0.0a2 * * * * * * * 2.3 Application Mantis Mantis 1.0.0a3 * * * * * * * -
OR - Configuration 2
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 OS Debian Debian Linux 3.1 * * * * * * * 2.3 OS Debian Debian Linux 3.1 * alpha * * * * * 2.3 OS Debian Debian Linux 3.1 * amd64 * * * * * 2.3 OS Debian Debian Linux 3.1 * arm * * * * * 2.3 OS Debian Debian Linux 3.1 * hppa * * * * * 2.3 OS Debian Debian Linux 3.1 * ia-32 * * * * * 2.3 OS Debian Debian Linux 3.1 * ia-64 * * * * * 2.3 OS Debian Debian Linux 3.1 * m68k * * * * * 2.3 OS Debian Debian Linux 3.1 * mips * * * * * 2.3 OS Debian Debian Linux 3.1 * mipsel * * * * * 2.3 OS Debian Debian Linux 3.1 * ppc * * * * * 2.3 OS Debian Debian Linux 3.1 * s-390 * * * * * 2.3 OS Debian Debian Linux 3.1 * sparc * * * * * 2.3 OS Gentoo Linux * * * * * * * *
Vulnerable Software List
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 3.1 |
| Mantis | Mantis | 0.19.0, 0.19.0_rc1, 0.19.0a1, 0.19.0a2, 0.19.1, 0.19.2, 1.0.0a1, 1.0.0a2, 1.0.0a3 |
| Gentoo | Linux | * |
References
| Name | Source | URL | Tags |
|---|---|---|---|
| 20050926 Mantis Bugtracker - Remote Database Scanner and XSS Vulnerabilities | http://marc.info/?l=bugtraq&m=112786017426276&w=2 | BUGTRAQ | |
| 16506 | http://secunia.com/advisories/16506 | SECUNIA | |
| DSA-778 | http://www.debian.org/security/2005/dsa-778 | DEBIAN | Patch Vendor Advisory |
| GLSA-200509-16 | http://www.gentoo.org/security/en/glsa/glsa-200509-16.xml | GENTOO | Patch Vendor Advisory |
| http://www.mantisbt.org/changelog.php | http://www.mantisbt.org/changelog.php | CONFIRM | |
| 14604 | http://www.securityfocus.com/bid/14604 | BID | Exploit Patch |
| mantis-bug-report-xss(21958) | https://exchange.xforce.ibmcloud.com/vulnerabilities/21958 | XF |