CVE-2012-1118

CVE-2012-1118 affects MantisBT before 1.2.9; the access_has_bug_level check fails when private_bug_view_threshold is an array, allowing bypass of private bug view restrictions and enabling certain operations on private bug reports. The description notes the vulnerability and its impact on access ...

CVE-2012-1118: Undefined Security Weakness

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...