Authentication Bypass

MantisBT is vulnerable to Authentication Bypass. The vulnerability is due to improper authentication in the SOAP API's mcichecklogin function, which allows an attacker to impersonate any user by supplying a valid cookiestring together with the target user's username without knowing the target's...

PT-2012-3095

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue allows remote attackers to bypass authentication. This is due to the mci check login function in the SOAP API, which permits authentication bypass via a null password. Recommendations For...