[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <m5cv0h$jsm$1@ger.gmane.org>
Date: Sat, 29 Nov 2014 18:16:01 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: CVE Request: DB credentials disclosure in MantisBT's unattended upgrade
script
Greetings,
Kindly assign a CVE ID for the following issue.
Description:
The unattended upgrade script retrieved DB connection settings from POST
parameters, allowing an attacker to get the script to connect to their
host with the current DB config credentials.
As per installation instructions [1], the admin/ directory (which
contains the vulnerable script) should be deleted in a Production instance.
Affected versions:
>= 1.1.0a3, <= 1.2.17
Fixed in versions:
1.2.18 (not yet released)
Patch:
See Github [2]
Credit:
Issue was reported by Mathias Karlsson (http://mathiaskarlsson.me) as
part of Offensive Security's bug bounty program [3].
It was fixed by Paul Richards.
References:
Further details available in our issue tracker [4]
[1]
https://mantisbt.org/docs/master-1.2.x/en/administration_guide/admin.install.postcommon.html
[2] http://github.com/mantisbt/mantisbt/commit/0826cef8
[3] http://www.offensive-security.com/bug-bounty-program/
[4] http://www.mantisbt.org/bugs/view.php?id=17877
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
