CVE-2023-22476 MantisBT: Exposure of Private issues' summary to unauthorized users

2023-02-2319:00:02

CWE-200

GitHub_M

www.cve.org

mantisbt

unauthorized access

private issues

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the Summary field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted bug_arr[] parameter in bug_actiongroup_ext.php. This issue is fixed in version 2.25.6. There are no workarounds.

CNA Affected

[
  {
    "vendor": "mantisbt",
    "product": "mantisbt",
    "versions": [
      {
        "version": "< 2.25.6",
        "status": "affected"
      }
    ]
  }
]