PT-2025-45718 · Packagist · Mantisbt/Mantisbt

Publicado 2025-11-03 · Atualizado 2025-11-03

OSV

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Impact

Due to insufficient access-level checks, any non-admin user having access to manage config columns page.php (typically project managers having MANAGER role) can use the Copy From action to retrieve the columns configuration from a private project they have no access to.

Access to the reverse operation ( Copy To ) is correctly controlled, i.e. it is not possible to alter the private project's configuration.

Patches

The vulnerability will be fixed in MantisBT version 2.27.2.

Workarounds

None

Credits

Thanks to d3vpoo1 for reporting the issue.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

GHSA-G582-8VWR-68H2

Produtos afetados

Mantisbt/Mantisbt

Referências · 6

• https://github.com/mantisbt/mantisbt · Nota
• https://github.com/mantisbt/mantisbt/commit/4fe94f45fa2baea2aeb4b65781d2009e7b4a0bf3 · Nota
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-g582-8vwr-68h2 · Nota
• https://osv.dev/vulnerability/GHSA-g582-8vwr-68h2 · Aviso do Fabricante
• https://mantisbt.org/bugs/view.php?id=36502 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-62520 · Nota de Segurança