CVE-2002-1112 - Vulnerability Details - OpenCVE

Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00625.

Key SSVC decision points have not yet been added.

Vendors	Products
Mantis	Mantis

Configuration 1 [-]

OR	cpe:2.3:a:mantis:mantis:0.15.3:::::::*
	cpe:2.3:a:mantis:mantis:0.15.4:::::::*
	cpe:2.3:a:mantis:mantis:0.15.5:::::::*
	cpe:2.3:a:mantis:mantis:0.15.6:::::::*
	cpe:2.3:a:mantis:mantis:0.15.7:::::::*
	cpe:2.3:a:mantis:mantis:0.15.8:::::::*
	cpe:2.3:a:mantis:mantis:0.15.9:::::::*
	cpe:2.3:a:mantis:mantis:0.15.10:::::::*
	cpe:2.3:a:mantis:mantis:0.15.11:::::::*
	cpe:2.3:a:mantis:mantis:0.15.12:::::::*
	cpe:2.3:a:mantis:mantis:0.16.0:::::::*
	cpe:2.3:a:mantis:mantis:0.16.1:::::::*
	cpe:2.3:a:mantis:mantis:0.17.0:::::::*
	cpe:2.3:a:mantis:mantis:0.17.1:::::::*
	cpe:2.3:a:mantis:mantis:0.17.2:::::::*
	cpe:2.3:a:mantis:mantis:0.17.3:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2002-1100	Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt
http://marc.info/?l=bugtraq&m=102978673018271&w=2
http://www.debian.org/security/2002/dsa-153
http://www.securityfocus.com/bid/5514
https://exchange.xforce.ibmcloud.com/vulnerabilities/9899

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2004-09-01T04:00:00

Updated: 2024-08-08T03:12:17.048Z

Reserved: 2002-09-06T00:00:00

Link: CVE-2002-1112

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2002-10-04T04:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2002-1112

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2002-08-19T00:00:00", "descriptions": [{"lang": "en", "value": "Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the \"View Bugs\" page."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2004-07-25T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-153", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2002/dsa-153"}, {"name": "20020819 [Mantis Advisory/2002-03] Bug listings of private projects can be viewed through cookie manipulation", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=102978673018271&w=2"}, {"name": "5514", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/5514"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt"}, {"name": "mantis-private-project-bug-listing(9899)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9899"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2002-1112", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the \"View Bugs\" page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-153", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2002/dsa-153"}, {"name": "20020819 [Mantis Advisory/2002-03] Bug listings of private projects can be viewed through cookie manipulation", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=102978673018271&w=2"}, {"name": "5514", "refsource": "BID", "url": "http://www.securityfocus.com/bid/5514"}, {"name": "http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt", "refsource": "CONFIRM", "url": "http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt"}, {"name": "mantis-private-project-bug-listing(9899)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9899"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T03:12:17.048Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-153", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2002/dsa-153"}, {"name": "20020819 [Mantis Advisory/2002-03] Bug listings of private projects can be viewed through cookie manipulation", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=102978673018271&w=2"}, {"name": "5514", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/5514"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt"}, {"name": "mantis-private-project-bug-listing(9899)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9899"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2002-1112", "datePublished": "2004-09-01T04:00:00", "dateReserved": "2002-09-06T00:00:00", "dateUpdated": "2024-08-08T03:12:17.048Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mantis:mantis:0.15.3:*:*:*:*:*:*:*", "matchCriteriaId": "5DF83421-973D-4AC9-BDA3-4161B9CF2D91", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.4:*:*:*:*:*:*:*", "matchCriteriaId": "1633BF3C-89C2-4BEF-9F56-6F19984D3CA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.5:*:*:*:*:*:*:*", "matchCriteriaId": "084BD5F4-37F8-4913-8045-769FD81F8C36", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.6:*:*:*:*:*:*:*", "matchCriteriaId": "76B09948-A44C-47D8-A5EC-3873FF36F451", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.7:*:*:*:*:*:*:*", "matchCriteriaId": "89D72C1E-73E5-4F51-9D30-D28026939C57", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.8:*:*:*:*:*:*:*", "matchCriteriaId": "E9EDAA7A-DF0C-4D9E-9D30-0422E4801612", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.9:*:*:*:*:*:*:*", "matchCriteriaId": "2C469C66-B64B-49BD-9D1C-D15F0E9028EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.10:*:*:*:*:*:*:*", "matchCriteriaId": "C28223A1-359F-434C-BAAA-82A5F310FA44", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.11:*:*:*:*:*:*:*", "matchCriteriaId": "7BF1F18B-AE36-48F3-B784-5C97B3F2535E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.15.12:*:*:*:*:*:*:*", "matchCriteriaId": "F073B8A1-3339-4BF2-B8D1-F6BA5CF9695A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.16.0:*:*:*:*:*:*:*", "matchCriteriaId": "6DAFD163-7FE7-48FB-8860-7B00B0FFA628", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.16.1:*:*:*:*:*:*:*", "matchCriteriaId": "03A0C36A-83DF-4E67-BA82-0ACE4D50C7D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.17.0:*:*:*:*:*:*:*", "matchCriteriaId": "53520AA0-E5AB-450A-9D95-E075B552D2E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "8462CB86-30B1-43D8-B306-271709423DB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.17.2:*:*:*:*:*:*:*", "matchCriteriaId": "131A96BB-EF2E-4AE2-9334-91CA96222BA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mantis:mantis:0.17.3:*:*:*:*:*:*:*", "matchCriteriaId": "17DC6205-7016-40C3-921A-B5AEC8513CCC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the \"View Bugs\" page."}], "id": "CVE-2002-1112", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2002-10-04T04:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=102978673018271&w=2"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.debian.org/security/2002/dsa-153"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.securityfocus.com/bid/5514"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9899"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=102978673018271&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.debian.org/security/2002/dsa-153"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.securityfocus.com/bid/5514"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9899"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}