PT-2019-11173 · Mantisbt · Mantisbt

Mustafa Hasan + 1 · Publicado 2019-06-06 · Atualizado 2019-06-09 · CVE-2018-9839

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MantisBT versions 1.3.14 and earlier, 2.0.0

Description: An issue was discovered in MantisBT where any user with REPORTER access or above can view any private issue's details, including summary, description, steps to reproduce, and additional information, when cloning it by using a crafted request on the "bug report page.php" endpoint and modifying the m id parameter. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public, except for private notes.

Recommendations: For MantisBT versions 1.3.14 and earlier, consider restricting access to the "bug report page.php" endpoint until a patch is available. For MantisBT version 2.0.0, avoid using the m id parameter in the "bug report page.php" endpoint until the issue is resolved. As a temporary workaround, consider disabling the clone operation for private issues until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-9839

Produtos afetados

Mantisbt

Referências · 6

• 🔥 https://mantisbt.org/bugs/view.php?id=24221 · Exploit
• https://github.com/mantisbt/mantisbt/commit/1fbcd9bca2f2c77cb61624d36ddee4b3802c38ea · Correção
• https://osv.dev/vulnerability/CVE-2018-9839 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-9839 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9839 · Nota
• https://t.me/cibsecurity/4738 · Publicação no Telegram