PT-2018-17614 · Mantisbt · Mantisbt

Foolandtom · Published 2018-02-02 · Updated 2018-04-08 · CVE-2018-6526

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MantisBT version 2.10.0-development before 2018-02-02

Description The issue allows remote attackers to discover the full path via an invalid filter parameter. This is related to a filter ensure valid filter call in current user api.php. The /view all bug page.php endpoint is affected.

Recommendations For MantisBT version 2.10.0-development before 2018-02-02, update to a version released after 2018-02-02 to resolve the issue. As a temporary workaround, consider restricting access to the /view all bug page.php endpoint until a patch is available. Avoid using invalid filter parameters in the affected endpoint until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-6526

Affected Products

Mantisbt

References · 6

• https://mantisbt.org/bugs/view.php?id=23921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6526 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6526 · Vendor Advisory
• https://github.com/mantisbt/mantisbt/commit/de686a9e6d8c909485b87ca09c8f912bf83082f2 · Note
• http://securityfocus.com/bid/103065 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6526 · Note