Unauthenticated attackers can hijack user accounts through password reset notifications

CVE-2024-23830

What is CVE-2024-23830?

An exploit in the MantisBT issue tracker allows an unauthenticated attacker to hijack user accounts by manipulating the password reset link. If the attacker knows a user's email address and username, they can exploit this vulnerability to gain unauthorized access. The issue has been addressed in version 2.26.1, where a patch is available to secure the affected functionality. Users are advised to update to the latest version or implement a workaround by configuring the $g_path setting in config_inc.php to mitigate potential attacks.

References