PT-2024-25691 · Mantisbt · Mantisbt

Vboctor · Published 2024-05-13 · Updated 2025-11-24 · CVE-2024-34080

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.26.2

Description The issue affects MantisBT, an open source issue tracker, where an issue referencing a note from another issue that the user does not have access to becomes hyperlinked. Although clicking the link results in an access denied error, some information remains accessible via the link, link label, and tooltip. This can lead to the disclosure of the note's existence, the note author's name, the note creation timestamp, and the issue ID the note belongs to.

Recommendations For versions prior to 2.26.2, update to version 2.26.2 to resolve the issue. As a temporary workaround, consider restricting access to hyperlinked notes to minimize the risk of information disclosure.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-34080

GHSA-99JC-WQMR-FF2Q

Affected Products

Mantisbt

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34080.json · Exploit
• https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226 · Patch
• https://github.com/mantisbt/mantisbt/pull/2000 · Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q · Vendor Advisory
• https://mantisbt.org/bugs/view.php?id=34434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34080 · Security Note
• https://osv.dev/vulnerability/GHSA-99jc-wqmr-ff2q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34080 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://twitter.com/CVEnew/status/1790043891644969137 · Twitter Post
• https://twitter.com/dailycve/status/1993086428545212481 · Twitter Post