CVE-2008-3333

Mantis < 1.1.2 - Remote File Inclusion via Language Parameter

Title source: llm
STIX 2.1

Description

Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user preferences page (account_prefs_update.php).

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30354
Various Sources x_refsource_confirm
http://www.mantisbt.org/bugs/view.php?id=9154
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43984
Various Sources x_refsource_confirm
http://www.mantisbt.org/bugs/changelog_page.php
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=456044
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30270
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200809-10.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31972
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29297

Scores

EPSS 0.0226
EPSS Percentile 80.8%

Details

CWE
CWE-22
Status published
Products (50)
mantis/mantis 0.9
mantis/mantis 0.9.0
mantis/mantis 0.9.1
mantis/mantis 0.10
mantis/mantis 0.10.0
mantis/mantis 0.10.1
mantis/mantis 0.10.2
mantis/mantis 0.11
mantis/mantis 0.11.0
mantis/mantis 0.11.1
... and 40 more
Published Jul 27, 2008
Tracked Since Feb 18, 2026