Lucene search

K
osvGoogleOSV:GHSA-H5Q3-FJP4-2X7R
HistorySep 30, 2024 - 5:48 p.m.

MantisBT vulnerable to information disclosure with user profiles

2024-09-3017:48:15
Google
osv.dev
2
mantisbt
information disclosure
user profiles
vulnerability
personal information
system profiles
platform
os
os version

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6

Confidence

High

EPSS

0

Percentile

16.3%

Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users’ personal system profiles.

Impact

Disclosure of private system profiles: Platform, OS, OS version, Description.

Patches

Work in progress

Workarounds

None

References

https://mantisbt.org/bugs/view.php?id=34640

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6

Confidence

High

EPSS

0

Percentile

16.3%

Related for OSV:GHSA-H5Q3-FJP4-2X7R