PT-2025-44804 · Unknown · Mantis Bug Tracker

Published 2025-11-03 · Updated 2025-11-05 · CVE-2025-55155

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker versions 2.27.1 and below

Description Mantis Bug Tracker is an open source issue tracker. When a user modifies their profile to update their email address, the system saves the change without verifying ownership. This can lead to storing an invalid email address, potentially preventing the user from receiving system notifications. Notifications being sent to an incorrect email address could result in information disclosure.

Recommendations Update to version 2.27.2 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-354

CWE-345

CWE-201

Related Identifiers

CVE-2025-55155

GHSA-Q747-C74M-69PR

Affected Products

Mantis Bug Tracker

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55155.json · Exploit
• https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e · Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55155 · Security Note
• https://osv.dev/vulnerability/GHSA-q747-c74m-69pr · Vendor Advisory
• https://mantisbt.org/bugs/view.php?id=36005 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://reddit.com/r/VulnMatter/comments/1ono2et/resumen_diario_de_vulnerabilidades_03112025 · Reddit Post
• https://t.me/CVEtracker/36556 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1oo83gr/resumen_diario_de_vulnerabilidades_04112025 · Reddit Post