Test ID:	1.3.6.1.4.1.25623.1.0.801449
Category:	Web application abuses
Title:	MantisBT < 1.2.2 Multiple Vulnerabilities
Summary:	MantisBT is prone to multiple vulnerabilities.
Description:	Summary: MantisBT is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - the application allows remote authenticated users to inject arbitrary web script or HTML via an HTML document with a '.gif' filename extension, related to inline attachments (CVE-2010-2802) - insecure handling of attachments and MIME types (CVE-2009-2802) Vulnerability Impact: Successful exploitation will allow attackers to conduct cross-site scripting, cross-domain scripting or other browser attacks. Affected Software/OS: MantisBT version prior to version 1.2.2. Solution: Update to version 1.2.2 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2802 [oss-security] 20100803 CVE request: Attachment XSS in mantis < 1.2.2 http://www.openwall.com/lists/oss-security/2010/08/02/16 [oss-security] 20100803 Re: CVE request: Attachment XSS in mantis < 1.2.2 http://www.openwall.com/lists/oss-security/2010/08/03/7 http://www.mantisbt.org/blog/?p=113 http://www.mantisbt.org/bugs/view.php?id=11952 https://bugzilla.redhat.com/show_bug.cgi?id=620992 Common Vulnerability Exposure (CVE) ID: CVE-2009-2802 https://security-tracker.debian.org/tracker/CVE-2009-2802
Copyright	Copyright (C) 2010 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.