VDB
CVE-2008-4688
CVE-2008-4688
PUBLISHED
CVSS 5 MEDIUM
core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.
EPSS 11.71% · 96.0th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
11.71%
96.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mantis | mantis | 1.0.2, 0, 0.19.3 |
| n/a | n/a | n/a |
Timeline
- Oct 22, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Sep 9, 2023 EPSS Score
References
- 32243 third-party-advisory
- 31868 vdb
- 32975 third-party-advisory
- GLSA-200812-07 vendor-advisory
- [oss-security] 20081020 Re: CVE request: mantisbt < 1.1.4: RCE mailing-list
- http://www.mantisbt.org/bugs/view.php?id=9321 url
- http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384 url
- http://www.mantisbt.org/bugs/changelog_page.php url
- https://nvd.nist.gov/vuln/detail/CVE-2008-4688 advisory