Pijama

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 2.24.3 **Description** An issue allows users without access to view private issue notes to download supposedly private attachments linked to these notes by directly accessing the corresponding file download URL. **Recommendations** For versions prior to 2.24.3, update to version 2.24.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the file download.php script until a patch is available.