PT-2024-31773 · Unknown · Mantis Bug Tracker

C-Schmitz · Published 2024-09-30 · Updated 2025-08-15 · CVE-2024-45792

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mantis Bug Tracker (MantisBT) versions prior to 2.26.4

Description: The issue allows an unprivileged, registered user to retrieve information about other users' personal system profiles using a crafted POST request. This can lead to the disclosure of private system profiles, including platform, OS, OS version, and description.

Recommendations: For versions prior to 2.26.4, update to version 2.26.4 to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-45792

GHSA-H5Q3-FJP4-2X7R

Affected Products

Mantis Bug Tracker

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45792.json · Exploit
• https://github.com/mantisbt/mantisbt/commit/ef0f820284032350cc20a39ff9cb2010d5463b41 · Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5q3-fjp4-2x7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45792 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45792 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/56bbd02dc1fb33a8de5898fd17dc3d698c847f55 · Note
• https://t.me/cvenotify/97032 · Telegram Post
• https://mantisbt.org/bugs/view.php?id=34640 · Note
• https://twitter.com/VulmonFeeds/status/1840793034117489146 · Twitter Post
• https://twitter.com/CVEnew/status/1840766396403261863 · Twitter Post
• https://t.me/cveNotify/132451 · Telegram Post
• https://t.me/cvedetector/6658 · Telegram Post