CVE-2008-3332: Code Injection
Published Jul 27, 2008
·Updated
Eval injection vulnerability in admconfigset.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter.
Affected Software
95 affected components
Mantis Mantis<=1.1.1
Mantis Mantis=0.9
Mantis Mantis=0.9.0
Mantis Mantis=0.9.1
Mantis Mantis=0.10
Mantis Mantis=0.10.0
Mantis Mantis=0.10.1
Mantis Mantis=0.10.2
Mantis Mantis=0.11
Mantis Mantis=0.11.0
Mantis Mantis=0.11.1
Mantis Mantis=0.12
Mantis Mantis=0.12.0
Mantis Mantis=0.13
Mantis Mantis=0.13.0
Mantis Mantis=0.13.1
Mantis Mantis=0.14
Mantis Mantis=0.14.0
Mantis Mantis=0.14.1
Mantis Mantis=0.14.2
Mantis Mantis=0.14.3
Mantis Mantis=0.14.4
Mantis Mantis=0.14.5
Mantis Mantis=0.14.6
Mantis Mantis=0.14.7
Mantis Mantis=0.14.8
Mantis Mantis=0.15
Mantis Mantis=0.15.0
Mantis Mantis=0.15.1
Mantis Mantis=0.15.2
Mantis Mantis=0.15.3
Mantis Mantis=0.15.4
Mantis Mantis=0.15.5
Mantis Mantis=0.15.6
Mantis Mantis=0.15.7
Mantis Mantis=0.15.8
Mantis Mantis=0.15.9
Mantis Mantis=0.15.10
Mantis Mantis=0.15.11
Mantis Mantis=0.15.12
Mantis Mantis=0.16
Mantis Mantis=0.16.0
Mantis Mantis=0.16.1
Mantis Mantis=0.17
Mantis Mantis=0.17.0
Mantis Mantis=0.17.1
Mantis Mantis=0.17.2
Mantis Mantis=0.17.3
Mantis Mantis=0.17.4
Mantis Mantis=0.17.4a
Mantis Mantis=0.17.5
Mantis Mantis=0.18
Mantis Mantis=0.18.0
Mantis Mantis=0.18.0_rc1
Mantis Mantis=0.18.0a1
Mantis Mantis=0.18.0a2
Mantis Mantis=0.18.0a3
Mantis Mantis=0.18.0a4
Mantis Mantis=0.18.1
Mantis Mantis=0.18.2
Mantis Mantis=0.18.3
Mantis Mantis=0.18a1
Mantis Mantis=0.19
Mantis Mantis=0.19.0
Mantis Mantis=0.19.0_rc1
Mantis Mantis=0.19.0a
Mantis Mantis=0.19.0a1
Mantis Mantis=0.19.0a2
Mantis Mantis=0.19.1
Mantis Mantis=0.19.2
Mantis Mantis=0.19.3
Mantis Mantis=0.19.4
Mantis Mantis=1.0
Mantis Mantis=1.0.0
Mantis Mantis=1.0.0_rc1
Mantis Mantis=1.0.0_rc2
Mantis Mantis=1.0.0_rc3
Mantis Mantis=1.0.0_rc4
Mantis Mantis=1.0.0_rc5
Mantis Mantis=1.0.0a1
Mantis Mantis=1.0.0a2
Mantis Mantis=1.0.0a3
Mantis Mantis=1.0.0rc1
Mantis Mantis=1.0.0rc2
Mantis Mantis=1.0.0rc3
Mantis Mantis=1.0.0rc4
Mantis Mantis=1.0.1
Mantis Mantis=1.0.2
Mantis Mantis=1.0.3
Mantis Mantis=1.0.4
Mantis Mantis=1.0.5
Mantis Mantis=1.0.6
Mantis Mantis=1.1
Mantis Mantis=1.1.0
Mantis Mantis=1.1.0a1
Event History
Jul 27, 2008
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3332?
CVE-2008-3332 is rated as a high severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2008-3332?
To fix CVE-2008-3332, upgrade to Mantis versions 1.1.2 or later where this vulnerability is addressed.
3
Who is affected by CVE-2008-3332?
CVE-2008-3332 affects all versions of Mantis before 1.1.2, including version 0.9 and various 1.0 and 1.1.x versions.
4
What type of attack can be performed using CVE-2008-3332?
An attacker can exploit CVE-2008-3332 to execute arbitrary PHP code through the value parameter in adm_config_set.php.
5
Is CVE-2008-3332 critical for Mantis administrators?
Yes, CVE-2008-3332 is critical for Mantis administrators as it allows unauthenticated users to execute potentially harmful code.