PT-2026-27178 · Oracle+1 · Mysql Server+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Mantis Bug Tracker versions prior to 2.28.1
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. An authentication bypass exists in the SOAP API when running on MySQL family databases due to improper type checking on the
password parameter. This occurs because MySQL performs implicit type conversion from string to integer. An attacker who knows a victim's username can use a crafted SOAP envelope to log in to the SOAP API without the actual password and execute any API function available to that account. This can allow an attacker to log in as an administrator using the password "0" to gain full project access.Recommendations
Update to version 2.28.1.
As a temporary workaround, disable the SOAP API to significantly reduce the risk, although this may still allow the retrieval of user account information such as email addresses and real names.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mantis Bug Tracker
Mysql Server