CVE-2005-2556: High severity Mantis Mantis vulnerability
core/databaseapi.php in Mantis 0.19.0a1 through 1.0.0a3, with registerglobals enabled, allows remote attackers to connect to internal databases by modifying the gdbtype variable and monitoring the speed of responses, as identified by bug#0005956.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2556?
CVE-2005-2556 is considered to be of medium severity due to its ability to allow remote attackers to connect to internal databases.
How do I fix CVE-2005-2556?
To fix CVE-2005-2556, disable register_globals in your PHP configuration and upgrade to a patched version of Mantis.
What software versions are affected by CVE-2005-2556?
CVE-2005-2556 affects Mantis versions 0.19.0a1 through 1.0.0a3 with register_globals enabled.
What type of attack is facilitated by CVE-2005-2556?
CVE-2005-2556 allows remote code execution attacks by manipulating the g_db_type variable to gain unauthorized access to internal databases.
Is updating to a newer version sufficient to remediate CVE-2005-2556?
Yes, updating to a version of Mantis released after 1.0.0a3 will remediate the vulnerability, along with disabling register_globals.