CVE-2004-1730: XSS

Published Dec 31, 2004

Updated

Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to loginpage.php, (2) e-mail field in signup.php, (3) action parameter to loginselectprojpage.php, or (4) hidestatus parameter to viewallset.php.

Affected Software

50 affected components

Mantis Mantis=0.10.2

Mantis Mantis=0.10

Mantis Mantis=0.14.7

Mantis Mantis=0.15.12

Mantis Mantis=0.18.0a2

Mantis Mantis=0.18.0a4

Mantis Mantis=0.15.3

Mantis Mantis=0.18

Mantis Mantis=0.15.9

Mantis Mantis=0.14.2

Mantis Mantis=0.9.1

Mantis Mantis=0.13

Mantis Mantis=0.10.1

Mantis Mantis=0.17.0

Mantis Mantis=0.15.10

Mantis Mantis=0.16.1

Mantis Mantis=0.15.2

Mantis Mantis=0.15.4

Mantis Mantis=0.15.11

Mantis Mantis=0.11

Mantis Mantis=0.17.4a

Mantis Mantis=0.14.5

Mantis Mantis=0.18.0a3

Mantis Mantis=0.17.2

Mantis Mantis=0.14.3

Mantis Mantis=0.15.7

Mantis Mantis=0.17.3

Mantis Mantis=0.17.1

Mantis Mantis=0.19.0a

Mantis Mantis=0.16

Mantis Mantis=0.18.0_rc1

Mantis Mantis=0.14.6

Mantis Mantis=0.14.4

Mantis Mantis=0.11.1

Mantis Mantis=0.15.5

Mantis Mantis=0.12

Mantis Mantis=0.15.1

Mantis Mantis=0.14.8

Mantis Mantis=0.17.5

Mantis Mantis=0.16.0

Mantis Mantis=0.18a1

Mantis Mantis=0.13.1

Mantis Mantis=0.15.8

Mantis Mantis=0.17.4

Mantis Mantis=0.14.1

Mantis Mantis=0.15.6

Mantis Mantis=0.17

Mantis Mantis=0.14

Mantis Mantis=0.15

Mantis Mantis=0.9

Remediation

Patch Available

http://secunia.com/advisories/12338

Event History

Dec 31, 2004

CVE Published

05:00 AM

Feb 26, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1730?

CVE-2004-1730 is considered to be of medium severity due to its potential for cross-site scripting attacks.

How do I fix CVE-2004-1730?

To mitigate CVE-2004-1730, you should upgrade Mantis bugtracker to a version that is not vulnerable to this cross-site scripting issue.

Which versions of Mantis are affected by CVE-2004-1730?

CVE-2004-1730 affects multiple versions of Mantis, specifically those prior to version 0.15.12.

What types of input can exploit CVE-2004-1730?

CVE-2004-1730 can be exploited through specific input fields, including the return parameter to login_page.php and the email field in signup.php.

What are the potential impacts of CVE-2004-1730?

The exploitation of CVE-2004-1730 may allow remote attackers to inject arbitrary web scripts or HTML, leading to various security issues such as session hijacking.