FreeBSD : mantis -- multiple vulnerabilities (19259833-26b1-11eb-a239-1c697a013f4b)

Mantis 2.24.3 release reports : This release fixes 3 security issues : - 0027039: CVE-2020-25781: Access to private bug note attachments - 0027275: CVE-2020-25288: HTML Injection on bugupdatepage.php - 0027304: CVE-2020-25830: HTML Injection in bugactiongrouppage.php C Tenable Network Security,...

CVE-2020-25781

An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the supposedly private attachments linked to these notes by accessing the corresponding file download URL directly...

CVE-2020-25781

An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the supposedly private attachments linked to these notes by accessing the corresponding file download URL directly...

CVE-2020-25781

An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the supposedly private attachments linked to these notes by accessing the corresponding file download URL directly...

CVE-2020-25781

Summary: The CVE-2020-25781 issue affects MantisBT prior to 2.24.3, specifically the file_download.php path. What is affected : the ability to download private issue note attachments without proper permissions. The underlying problem is improper authorization for accessing file download URLs link...

mantis -- multiple vulnerabilities

Mantis 2.24.3 release reports: This release fixes 3 security issues: 0027039: CVE-2020-25781: Access to private bug note attachments 0027275: CVE-2020-25288: HTML Injection on bugupdatepage.php 0027304: CVE-2020-25830: HTML Injection in bugactiongrouppage.php...