CVE-2008-3333: Path Traversal
Directory traversal vulnerability in core/langapi.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user preferences page (accountprefsupdate.php).
Other sources
New upstream Mantis version 1.1.2 fixes following security issue:
- 0009154: [security] arbitrary file inclusion through user preferences page (giallu) - closed.
http://www.mantisbt.org/bugs/changelogpage.php
Upstream bug report:
http://www.mantisbt.org/bugs/view.php?id=9154
Vulnerability overview: ----------------------- Due to unchecked user input, arbitrary files can be included within a PHP requireonce() statement. Input length is limited to 32 characters. This vulnerability allows for reading arbitrary files on the affected webserver, as well as code execution if the attacker can put php code in any includable file (which is possible in most scenarios).
Vulnerability description: -------------------------- Vulnerable files/objects: core/langapi.php, accountprefsupdate.php
Line 37 (in "core/langapi.php") loads text file with user-supplied language preference.
---cut here--- requireonce( $tlangdir . 'strings' . $plang . '.txt' ); ---cut here---
Proof of concept: ----------------- Use accountprefsupdate.php to set language to something like:
language=urdu.txt/../../../../etc/passwd%00
Fix in upstream SVN: http://mantisbt.svn.sourceforge.net/viewvc/mantisbt?view=rev&revision=5270
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3333?
The severity of CVE-2008-3333 is considered high due to the potential for remote code execution via a directory traversal vulnerability.
How do I fix CVE-2008-3333?
To fix CVE-2008-3333, upgrade Mantis to version 1.1.2 or later which addresses this vulnerability.
What version of Mantis is affected by CVE-2008-3333?
CVE-2008-3333 affects all Mantis versions prior to 1.1.2, including versions like 0.10.2, 0.12.0, 0.14.7, and more.
What type of vulnerability is CVE-2008-3333?
CVE-2008-3333 is a directory traversal vulnerability that allows attackers to include and execute arbitrary files.
Can I still use Mantis if I haven't patched CVE-2008-3333?
It is strongly advised not to use Mantis without patching CVE-2008-3333 due to security risks associated with unpatched vulnerabilities.