CVE-2010-4349: Infoleak
admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4349?
CVE-2010-4349 is classified as a moderate severity vulnerability due to its potential exposure of sensitive information.
How do I fix CVE-2010-4349?
To fix CVE-2010-4349, upgrade MantisBT to version 1.2.4 or later, which addresses this vulnerability.
What types of information can be exposed due to CVE-2010-4349?
CVE-2010-4349 can expose sensitive information including the installation path of the MantisBT application.
Which versions of MantisBT are affected by CVE-2010-4349?
CVE-2010-4349 affects all MantisBT versions prior to 1.2.4.
Is there a workaround for CVE-2010-4349 if I cannot upgrade immediately?
While the best solution is to upgrade, you can restrict access to the upgrade_unattended.php script as a temporary workaround to mitigate the risk.