MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

Impact MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to access. Patches - b262b4d2835b81394d75356dead66e52a6275206 Workarounds None. Credits Thanks to Vishal Shukla for discovering and responsibly reporting the issue...

PT-2012-1733

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 4.x before 4.2rc1 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for uploading attachments. Recommendations For Bugzilla versions 2.x through 4.x...