PT-2018-17614 · Mantisbt · Mantisbt

Foolandtom · Publicado 2018-02-02 · Atualizado 2018-04-08 · CVE-2018-6526

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MantisBT version 2.10.0-development before 2018-02-02

Description The issue allows remote attackers to discover the full path via an invalid filter parameter. This is related to a filter ensure valid filter call in current user api.php. The /view all bug page.php endpoint is affected.

Recommendations For MantisBT version 2.10.0-development before 2018-02-02, update to a version released after 2018-02-02 to resolve the issue. As a temporary workaround, consider restricting access to the /view all bug page.php endpoint until a patch is available. Avoid using invalid filter parameters in the affected endpoint until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-6526

Produtos afetados

Mantisbt

Referências · 6

• https://github.com/mantisbt/mantisbt/commit/de686a9e6d8c909485b87ca09c8f912bf83082f2 · Nota
• https://mantisbt.org/bugs/view.php?id=23921 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6526 · Nota de Segurança
• http://securityfocus.com/bid/103065 · Nota
• https://osv.dev/vulnerability/CVE-2018-6526 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6526 · Nota