CVE:CVE-2006-0841
CNNVD:CNNVD-200602-329
Mantis 1.00rc4及之前版本中存在多个跨站脚本攻击(XSS)漏洞。远程攻击者可以借助(a) view_all_set.php中的(1) hide_status、(2) handler_id、(3) user_monitor、(4) reporter_id、(5) view_type、(6) show_severity、(7) show_category、(8) show_status、(9) show_resolution、(10) show_build、(11) show_profile、(12) show_priority、(13) highlight_changed、(14) relationship_type和(15) relationship_bug参数；(b) manage_user_page.php中的(16) sort参数；(c) view_filters_page.php中的(17) view_type参数；以及(d) proj_doc_delete.php中的(18) title参数注入任意Web脚本或HTML。注意：第17项可能包含在CVE-2005-4522中。
solution:Upgrade mantis mantis to a higher version than 0.9,0.9.0,0.9.1,0.10,0.10.0,0.10.1,0.10.2,0.11,0.11.0,0.11.1,0.12,0.12.0,0.13,0.13.0,0.13.1,0.14,0.14.0,0.14.1,0.14.2,0.14.3,0.14.4,0.14.5,0.14.6,0.14.7,0.14.8,0.15,0.15.0,0.15.1,0.15.2,0.16,0.16.0,0.17,0.17.0,0.17.4a,0.18,0.18.0,0.18.0_rc1,0.18.0a1,0.18.0a2,0.18.0a3,0.18.0a4,0.18.1,0.18.2,0.18.3,0.18a1,0.19.0,0.19.0_rc1,0.19.0a,0.19.0a1,0.19.0a2,0.19.1,0.19.2,0.19.3,0.19.4,1.0.0_rc1,1.0.0_rc2,1.0.0_rc3,1.0.0_rc4,1.0.0a1,1.0.0a2,1.0.0a3,and avoid the version 0.9,0.9.0,0.9.1,0.10,0.10.0,0.10.1,0.10.2,0.11,0.11.0,0.11.1,0.12,0.12.0,0.13,0.13.0,0.13.1,0.14,0.14.0,0.14.1,0.14.2,0.14.3,0.14.4,0.14.5,0.14.6,0.14.7,0.14.8,0.15,0.15.0,0.15.1,0.15.2,0.16,0.16.0,0.17,0.17.0,0.17.4a,0.18,0.18.0,0.18.0_rc1,0.18.0a1,0.18.0a2,0.18.0a3,0.18.0a4,0.18.1,0.18.2,0.18.3,0.18a1,0.19.0,0.19.0_rc1,0.19.0a,0.19.0a1,0.19.0a2,0.19.1,0.19.2,0.19.3,0.19.4,1.0.0_rc1,1.0.0_rc2,1.0.0_rc3,1.0.0_rc4,1.0.0a1,1.0.0a2,1.0.0a3