Описание
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.
Ссылки
- Patch
- Vendor Advisory
- ExploitIssue TrackingVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.27.2 (исключая)
cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
EPSS
Процентиль: 16%
0.00246
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-285
Связанные уязвимости
CVSS3: 4.3
debian
10 месяцев назад
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In vers ...
CVSS3: 4.3
github
10 месяцев назад
MantisBT unauthorized disclosure of private project column configuration
EPSS
Процентиль: 16%
0.00246
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-285