« Volver al listado

CVE-2008-4688

Estado: ModificadaMedia (5)—

core/string_api.php en Mantis anterior a 1.1.3 no valida los privilegios del visor antes de crear un enlace con los datos de la incidencia en el identificador de origen, lo que permite a atacantes remotos conocer el título y estado de la incidencia a través de una petición con un número de incidencia modificado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mantis — Mantis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4688",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-10-22T18:00:01.237",
  "references": [
    {
      "url": "http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32243",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32975",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mantisbt.org/bugs/changelog_page.php",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mantisbt.org/bugs/view.php?id=9321",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2008/10/20/1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31868",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32243",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32975",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mantisbt.org/bugs/changelog_page.php",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mantisbt.org/bugs/view.php?id=9321",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2008/10/20/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31868",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number."
    },
    {
      "lang": "es",
      "value": "core/string_api.php en Mantis anterior a 1.1.3 no valida los privilegios del visor antes de crear un enlace con los datos de la incidencia en el identificador de origen, lo que permite a atacantes remotos conocer el título y estado  de la incidencia a través de una petición con un número de incidencia modificado."
    }
  ],
  "lastModified": "2026-06-16T22:58:19.220",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mantis:mantis:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "132BAF7E-8047-417F-8C78-1C1FBDAF97A0",
              "versionEndIncluding": "1.1.3"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:0.19.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D8E7458-6655-4C86-85A9-81004FF38321"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:0.19.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE92E018-C25C-468D-9EF5-5665F0B42EA2"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA5AE0B4-15AB-49E7-9B97-96BA322B0966"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48069606-59B6-4D20-B909-997CA7EDBD2B"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E42CD1CB-49E7-484B-9629-78A24B754346"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F95B327F-94A8-4D4F-A330-1B9BF4B764FD"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "215420D5-4690-45BE-AE84-CF1522523299"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5621726F-CA50-4336-9BCE-55F39BE5CDCF"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B0ECF83-F61A-4745-AA0D-4822A38F24DA"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91621575-AF90-4C01-AA87-A99C304227D6"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAEE63A1-106C-4E50-8B6F-D134C69FD194"
            },
            {
              "criteria": "cpe:2.3:a:mantis:mantis:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7729C7E-ECC1-48D0-BFF7-82A8D96DC0AF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}