Incorrect Authorization

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Incorrect Authorization in the mcissueupdate function. An attacker can modify, edit, or change the visibility of bugnotes belonging to other users by leveraging insufficient access control chec...

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

The mcissueupdate function in MantisBT allows users having updatebugthreshold access UPDATER, with default settings to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER level 55 threshold required by the dedicated...

MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values

Improper escaping of a textarea custom field's contents in the Update Issue page bugupdatepage.php allows an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. Impact Session theft leading to admin account takeover, full project data access....

GHSA-QJ6W-V29Q-4RGX MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values

Improper escaping of a textarea custom field's contents in the Update Issue page bugupdatepage.php allows an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. Impact Session theft leading to admin account takeover, full project data access....

MINI-VQ55-JHVF-M27V

Bulletin has no description...

MINI-RVRR-2HR9-CM73

Bulletin has no description...

MINI-R279-C9Q3-786M

Bulletin has no description...

MINI-H76C-V87M-VHJ6

Bulletin has no description...

MINI-GRRH-9RPX-9VXF

Bulletin has no description...

MINI-GHW7-PHC7-VFCF

Bulletin has no description...

MINI-CCV6-4FH6-26GF

Bulletin has no description...

MINI-962R-JFV7-P62V

Bulletin has no description...

MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue. Impact Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure. Patches - 71df1f67e05b2050cd4bd87839e6cc13747cf03f Workarounds None Credits...

GHSA-CRMX-4P49-46M2 MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue. Impact Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure. Patches - 71df1f67e05b2050cd4bd87839e6cc13747cf03f Workarounds None Credits...

MINI-66H2-MF23-2C6J

Bulletin has no description...

MINI-4C63-W55M-3C4G

Bulletin has no description...

GHSA-RMP5-5JJ7-GMVF MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue

MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after that Issue becomes private and direct access to it is denied. Impact The loss of confidentiality caused by this vulnerability is minimal, considering that only the attachments that...

MINI-3Q73-WXPX-QV79

Bulletin has no description...

MINI-35CR-PP68-VGQ2

Bulletin has no description...

GHSA-GGW7-9675-6V4V MantisBT has an authorization bypass in private issue monitoring

Using a crafted POST request to bugmonitoradd.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private...