CVE-2005-3090: XSS

Published Sep 28, 2005

Updated

Cross-site scripting (XSS) vulnerability in bugactiongrouppage.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the summary of the bug, which is not quoted when viewallbugpage.php is used to delete the bug, as identified by bug#0006002, a different vulnerability than CVE-2005-2557.

Affected Software

9 affected components

Mantis Mantis=0.19.0a1

Mantis Mantis=0.19.0a2

Mantis Mantis=1.0.0a3

Mantis Mantis=1.0.0a1

Mantis Mantis=0.19.0_rc1

Mantis Mantis=1.0.0a2

Mantis Mantis=0.19.0

Mantis Mantis=0.19.1

Mantis Mantis=0.19.2

Remediation

Patch Available

http://www.debian.org/security/2005/dsa-778

Event History

Sep 28, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3090?

CVE-2005-3090 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2005-3090?

To fix CVE-2005-3090, upgrade your MantisBT installation to a version that is not affected, such as any version beyond 1.0.0a3.

What software is affected by CVE-2005-3090?

CVE-2005-3090 affects MantisBT versions 0.19.0a1 through 1.0.0a3.

Who can exploit CVE-2005-3090?

Remote attackers can exploit CVE-2005-3090 by injecting arbitrary web scripts or HTML through the summary of a bug report.

What impact does CVE-2005-3090 have on users?

CVE-2005-3090 can lead to unauthorized scripting attacks, potentially compromising user data and session integrity.