oss-sec mailing list archives
CVE Request: DB credentials disclosure in MantisBT's unattended upgrade script
From: Damien Regad <dregad () mantisbt org>
Date: Sat, 29 Nov 2014 18:16:01 +0100
Greetings, Kindly assign a CVE ID for the following issue. Description:The unattended upgrade script retrieved DB connection settings from POST parameters, allowing an attacker to get the script to connect to their host with the current DB config credentials.
As per installation instructions [1], the admin/ directory (which contains the vulnerable script) should be deleted in a Production instance.
Affected versions: >= 1.1.0a3, <= 1.2.17 Fixed in versions: 1.2.18 (not yet released) Patch: See Github [2] Credit:Issue was reported by Mathias Karlsson (http://mathiaskarlsson.me) as part of Offensive Security's bug bounty program [3].
It was fixed by Paul Richards. References: Further details available in our issue tracker [4][1] https://mantisbt.org/docs/master-1.2.x/en/administration_guide/admin.install.postcommon.html
[2] http://github.com/mantisbt/mantisbt/commit/0826cef8 [3] http://www.offensive-security.com/bug-bounty-program/ [4] http://www.mantisbt.org/bugs/view.php?id=17877
Current thread:
- CVE Request: DB credentials disclosure in MantisBT's unattended upgrade script Damien Regad (Nov 29)