CVE-2006-0841: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hidestatus, (2) handlerid, (3) usermonitor, (4) reporterid, (5) viewtype, (6) showseverity, (7) showcategory, (8) showstatus, (9) showresolution, (10) showbuild, (11) showprofile, (12) showpriority, (13) highlightchanged, (14) relationshiptype, and (15) relationshipbug parameters in (a) viewallset.php; the (16) sort parameter in (b) manageuserpage.php; the (17) viewtype parameter in (c) viewfilterspage.php; and the (18) title parameter in (d) projdocdelete.php. NOTE: item 17 might be subsumed by CVE-2005-4522.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0841?
CVE-2006-0841 has a moderate severity level due to the risk of XSS attacks that can lead to unauthorized access or data manipulation.
How do I fix CVE-2006-0841?
To fix CVE-2006-0841, update Mantis to version 1.0.0 or later to avoid the known cross-site scripting vulnerabilities.
What versions of Mantis are affected by CVE-2006-0841?
CVE-2006-0841 affects Mantis versions 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, and 0.15 up to 1.0.0rc4.
Can CVE-2006-0841 be exploited remotely?
Yes, CVE-2006-0841 can be exploited remotely by attackers to inject arbitrary web scripts or HTML into affected Mantis installations.
What type of vulnerability is CVE-2006-0841?
CVE-2006-0841 is classified as a cross-site scripting (XSS) vulnerability.