MantisBT Access Control Error Vulnerability (CNVD-2021-09042)

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. An access control error vulnerability exists in MantisBT versions prior to 2.24.4, which stems from the fact th...

MantisBT Authorization Issues Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions prior to 2.24.4, which allows any logged in user who is allowed...

MantisBT Information Disclosure Vulnerability (CNVD-2021-09043)

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions prior to 2.24.4, which stems from a lack of access checkin...

CVE-2020-29604

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker with rights to create new issues to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue i.e., one having Private view status, or...

CVE-2020-29604

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker with rights to create new issues to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue i.e., one having Private view status, or...

CVE-2020-29605

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

CVE-2020-29603

In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them...

CVE-2020-29605

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

CVE-2020-29603

In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them...

Design/Logic Flaw

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker with rights to create new issues to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue i.e., one having Private view status, or...

Design/Logic Flaw

In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them...

Improper access control

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

CVE-2020-29604

MantisBT before 2.24.4 suffers a missing access check in bug_actiongroup.php, enabling a user with rights to create issues to copy a private issue (via bug_arr[]) and clone it with all bugnotes and attachments, exposing confidential data. Affected: MantisBT

CVE-2020-29604

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker with rights to create new issues to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue i.e., one having Private view status, or...

CVE-2020-29605

CVE-2020-29605 affects MantisBT prior to 2.24.4. The issue arises from insufficient access checks in the group actions flow: any logged-in user permitted to perform Group Actions can read the Summary field of private Issues via a crafted bug_actiongroup_page.php URL using bug_arr[] (target can be...

CVE-2020-29605

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

CVE-2020-29603

In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them...

CVE-2020-29603

Summary: CVE-2020-29603 affects MantisBT prior to 2.24.4. An unprivileged logged-in user can request the manage_proj_edit_page.php with a project_id and obtain names of Private Projects without having access to them. Impact: private project identifiers/names exposure, enabling potential informati...

CVE-2020-36192

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues either marked as Private, or part of a private Project, if they are attached to an existing Changeset. The information is visible on the view.php...

CVE-2020-36192

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues either marked as Private, or part of a private Project, if they are attached to an existing Changeset. The information is visible on the view.php...