GHSA-h5q3-fjp4-2x7rMediumCVSS 4.3
MantisBT vulnerable to information disclosure with user profiles
🔗 CVE IDs covered (1)
📋 Description
Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles.
Impact
Disclosure of private system profiles: Platform, OS, OS version, Description.
Patches
- https://github.com/mantisbt/mantisbt/commit/56bbd02dc1fb33a8de5898fd17dc3d698c847f55
Workarounds
None
References
https://mantisbt.org/bugs/view.php?id=34640
🎯 Affected products1
- composer/mantisbt/mantisbt:<= 2.26.3
🔗 References (6)
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7r
- https://nvd.nist.gov/vuln/detail/CVE-2024-45792
- https://github.com/mantisbt/mantisbt/commit/ef0f820284032350cc20a39ff9cb2010d5463b41
- https://mantisbt.org/bugs/view.php?id=34640
- https://github.com/mantisbt/mantisbt/commit/56bbd02dc1fb33a8de5898fd17dc3d698c847f55
- https://github.com/advisories/GHSA-h5q3-fjp4-2x7r