« Volver al listado

CVE-2006-6574

Estado: ModificadaMedia (5)—

Mantis anterior a 1.1.0a2 no implementa el control de acceso del por artículo para Issue History (Bug History), lo cual permite a un atacante remoto obtener información sensible a través de la lectura de la columna Change, como se demostró por la columna Change de un campo cliente.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mantis — Mantis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-6574",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-12-15T19:28:00.000",
  "references": [
    {
      "url": "http://bugs.mantisbugtracker.com/view.php?id=3375",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.mantisbugtracker.com/view.php?id=7364",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?r1=1.34&r2=1.35",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?view=log",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/23258",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28551",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?release_id=469627",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1467",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mantisbugtracker.com/changelog.php",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/21566",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/4978",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30870",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.mantisbugtracker.com/view.php?id=3375",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://bugs.mantisbugtracker.com/view.php?id=7364",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?r1=1.34&r2=1.35",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?view=log",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/23258",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28551",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?release_id=469627",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1467",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mantisbugtracker.com/changelog.php",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/21566",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/4978",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30870",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field."
    },
    {
      "lang": "es",
      "value": "Mantis anterior a 1.1.0a2 no implementa el control de acceso del por artículo para Issue History (Bug History), lo cual permite a un atacante remoto obtener información sensible a través de la lectura de la columna Change, como se demostró por la columna Change de un campo cliente."
    }
  ],
  "lastModified": "2026-06-16T22:33:23.867",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mantis:mantis:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A878BD34-787E-4330-9EE2-D1CD7FE6678E",
              "versionEndIncluding": "1.1.0a1"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "781910F1-C34C-49D6-80D2-62AC80AF17DE"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0_rc1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6DB707C-29DF-442C-BBBE-650182692A33"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0_rc2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C420189-4748-465C-96FE-DC89502F7E26"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0_rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B3A1BAC-F777-413E-BFB7-972C687C2D92"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0_rc4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C7EDA7-1BED-4152-BD3D-3A596482D9D6"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0_rc5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B54BEEA5-B671-4BDE-96D1-B235CF8F197E"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0a1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "730BE023-C283-4775-915C-79817723917A"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0a2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "337E18A7-07A3-456D-868A-2002F96D7A2A"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.0a3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84B09B6D-EE4D-4241-B3EF-CBCB03A7F579"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA5AE0B4-15AB-49E7-9B97-96BA322B0966"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48069606-59B6-4D20-B909-997CA7EDBD2B"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E42CD1CB-49E7-484B-9629-78A24B754346"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F95B327F-94A8-4D4F-A330-1B9BF4B764FD"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "215420D5-4690-45BE-AE84-CF1522523299"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5621726F-CA50-4336-9BCE-55F39BE5CDCF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}