ID de Prueba:	1.3.6.1.4.1.25623.1.0.62858
Categoría:	FreeBSD Local Security Checks
Título:	FreeBSD Ports: mantis
Resumen:	The remote host is missing an update to the system; as announced in the referenced advisory.
Descripción:	Summary: The remote host is missing an update to the system as announced in the referenced advisory. Vulnerability Insight: The following package is affected: mantis CVE-2008-2276 Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link. CVE-2008-3331 Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the filter_target parameter. CVE-2008-3332 Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter. CVE-2008-3333 Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user preferences page (account_prefs_update.php). Solution: Update your system with the appropriate patches or software upgrades. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-2276 BugTraq ID: 29297 http://www.securityfocus.com/bid/29297 Bugtraq: 20080520 Mantis Bug Tracker 1.1.1 Multiple Vulnerabilities (Google Search) http://marc.info/?l=bugtraq&m=121130774617956&w=4 https://www.exploit-db.com/exploits/5657 https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00801.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00813.html http://www.gentoo.org/security/en/glsa/glsa-200809-10.xml http://secunia.com/advisories/30270 http://secunia.com/advisories/31171 http://secunia.com/advisories/31972 http://www.vupen.com/english/advisories/2008/1598/references XForce ISS Database: mantis-usercreate-csrf(42447) https://exchange.xforce.ibmcloud.com/vulnerabilities/42447 Common Vulnerability Exposure (CVE) ID: CVE-2008-3331 http://securityreason.com/securityalert/4044 XForce ISS Database: mantis-returndynamicfilters-xss(42549) https://exchange.xforce.ibmcloud.com/vulnerabilities/42549 Common Vulnerability Exposure (CVE) ID: CVE-2008-3332 XForce ISS Database: mantis-admconfigset-code-execution(42550) https://exchange.xforce.ibmcloud.com/vulnerabilities/42550 Common Vulnerability Exposure (CVE) ID: CVE-2008-3333 BugTraq ID: 30354 http://www.securityfocus.com/bid/30354 XForce ISS Database: mantis-accountprefsupdate-file-include(43984) https://exchange.xforce.ibmcloud.com/vulnerabilities/43984
Copyright	Copyright (C) 2008 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.