Date: Sat, 17 Jan 2015 01:01:55 +0100 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Cc: advisory@...ridge.ch Subject: CVE-2014-9572: Improper Access Control in install.php Greetings, Please update CVE-2014-9572 with the information below Description: The vulnerability exists due to insufficient access restrictions to the installation script "/[admin]/install.php" when HTTP GET "install" parameter is set to "4". A remote unauthenticated attacker can access the installation script and obtain database access credentials, which are stored in plain text in hidden form fields. An attacker can use the following URL to access the page and obtain database credentials (login and password) in plaintext: http://mantis/[admin]/install.php?install=4 [^] Note, that "[admin]" in the URL is changed by default during installation. Therefore, the attacker must know the location of the administrative interface in order to perform the attack. However, admin panel URL can be bruteforced or predicted in many cases. Affected versions: - <= 1.2.19 - <= 1.3.0-beta.1 Fixed in versions: - 1.2.19 (not yet released) - 1.3.0-beta.2 (not yet released) Patch: See Github  Credit: This vulnerability was reported  by High-Tech Bridge Security Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 . The issue was fixed by Damien Regad (MantisBT Developer). References: Further details available in our issue tracker   http://github.com/mantisbt/mantisbt/commit/5571bcf9 (1.2.x) http://github.com/mantisbt/mantisbt/commit/5e5e5750 (1.3.x)  https://www.mantisbt.org/bugs/view.php?id=17937  https://www.htbridge.com/advisory/HTB23243  https://www.mantisbt.org/bugs/view.php?id=17939
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ