CVE-2004-2666: Medium severity Mantis Mantis vulnerability

Published Dec 31, 2004

Updated

Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of viewhistorythreshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.

Affected Software

56 affected components

Mantis Mantis=0.10.2

Mantis Mantis=0.10

Mantis Mantis=0.14.7

Mantis Mantis=0.19

Mantis Mantis=0.18.2

Mantis Mantis=0.15.12

Mantis Mantis=0.18.0a2

Mantis Mantis=0.18.0a4

Mantis Mantis=0.15.3

Mantis Mantis=0.18

Mantis Mantis=0.15.9

Mantis Mantis=0.14.2

Mantis Mantis=0.9.1

Mantis Mantis=0.13

Mantis Mantis=0.10.1

Mantis Mantis=0.15.10

Mantis Mantis=0.16.1

Mantis Mantis=0.15.2

Mantis Mantis=0.15.4

Mantis Mantis=0.15.11

Mantis Mantis=0.19.0a1

Mantis Mantis=0.11

Mantis Mantis=0.17.4a

Mantis Mantis=0.14.5

Mantis Mantis=0.19.0a2

Mantis Mantis=0.18.0a3

Mantis Mantis=0.17.2

Mantis Mantis=0.18.3

Mantis Mantis=0.14.3

Mantis Mantis=0.15.7

Mantis Mantis=0.17.3

Mantis Mantis=0.19.0_rc1

Mantis Mantis=0.17.1

Mantis Mantis=0.19.0a

Mantis Mantis=0.16

Mantis Mantis=0.18.0_rc1

Mantis Mantis=0.14.6

Mantis Mantis=0.14.4

Mantis Mantis=0.11.1

Mantis Mantis=0.18.0a1

Mantis Mantis=0.15.5

Mantis Mantis=0.12

Mantis Mantis=0.15.1

Mantis Mantis=0.14.8

Mantis Mantis=0.17.5

Mantis Mantis=0.18a1

Mantis Mantis=0.13.1

Mantis Mantis=0.15.8

Mantis Mantis=0.17.4

Mantis Mantis=0.14.1

Mantis Mantis=0.18.1

Mantis Mantis=0.15.6

Mantis Mantis=0.17

Mantis Mantis=0.14

Mantis Mantis=0.15

Mantis Mantis=0.9

Remediation

Patch Available

http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/history_inc.php?view=log

Event History

Dec 31, 2004

CVE Published

05:00 AM

Dec 16, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2666?

CVE-2004-2666 has a medium severity rating as it allows remote attackers to access private bug details.

How do I fix CVE-2004-2666?

To fix CVE-2004-2666, you should upgrade to Mantis versions after 20041016 which contain the necessary security patches.

What types of data are exposed by CVE-2004-2666?

CVE-2004-2666 exposes sensitive information including private bug details stored in the Mantis bug tracking system.

Which versions of Mantis are affected by CVE-2004-2666?

CVE-2004-2666 affects Mantis versions 0.10.2 and earlier, including various other versions in the 0.10.x, 0.14.x, and 0.19.x series.

How can attackers exploit CVE-2004-2666?

Attackers can exploit CVE-2004-2666 by simply visiting the web page of a bug report to view its complete issue history regardless of user permissions.