CVE-2002-1112

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt
http://marc.info/?l=bugtraq&m=102978673018271&w=2
http://www.debian.org/security/2002/dsa-153Patch, Vendor Advisory
http://www.securityfocus.com/bid/5514Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/9899
http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt
http://marc.info/?l=bugtraq&m=102978673018271&w=2
http://www.debian.org/security/2002/dsa-153Patch, Vendor Advisory
http://www.securityfocus.com/bid/5514Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/9899

Timeline

Published: Oct 4, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-11137.5summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_pa CVE-2002-11147.5config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) g_b CVE-2002-11155.0Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_pa CVE-2002-11167.5The "View Bugs" page (view_all_bug_page.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have acc CVE-2002-11175.0Veritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which e CVE-2002-11185.0TNS Listener in Oracle Net Services for Oracle 9i 9.2.x and 9.0.x, and Oracle 8i 8.1.x, allows remote attackers to cause a denial of service CVE-2002-11194.6os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute CVE-2002-11207.5Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.CVE-2002-11217.5SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3 CVE-2002-11227.5Buffer overflow in the parsing mechanism for ISS Internet Scanner 6.2.1, when using the license banner HTTP check, allows remote attackers t CVE-2002-11237.5Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attacker CVE-2002-11247.2Multiple buffer overflows in purity 1-16 allow local users to gain privileges and modify high scores tables.