CVE-2008-3332: Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated admin...

Security readout for executives and security teams

CVE-2008-3332 affects old Mantis installations before 1.1.2. An authenticated administrator could abuse a configuration endpoint to run arbitrary server-side code. This is serious for any still-running legacy Mantis instance, but the provided sources do not show active exploitation. Exposure is likely limited to organizations still operating Mantis versions earlier than 1.1.2, especially internet-accessible or weakly governed administrative panels. Treat as high priority only where legacy Mantis is present. The business risk is server compromise through an administrator-level path, not broad unauthenticated mass exploitation based on the provided evidence. Mitigation focus: Upgrade Mantis to 1.1.2 or later, following vendor guidance.; Apply relevant distribution fixes, such as Gentoo security guidance where applicable.; Restrict administrative access to trusted networks and named administrators..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.