Flaw in MantisBT Allows Unauthorized Access to Issue Data
CVE-2008-4688

Currently unrated

Key Information:

Vendor

Mantis

Status
Mantis
Vendor
CVE Published:
22 October 2008

What is CVE-2008-4688?

A security flaw in MantisBT versions prior to 1.1.3 exists in the core/string_api.php file, which fails to verify user permissions when generating links containing issue data. This oversight allows remote attackers to manipulate requests with altered issue numbers, thereby disclosing sensitive information such as issue titles and statuses to unauthorized parties.

References

http://secunia.com/advisories/32243
third-party-advisoryx_refsource_SECUNIA
http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branc...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/31868
vdb-entryx_refsource_BID

EPSS Score

11% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.