Headline
GHSA-99jc-wqmr-ff2q: MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
If an issue references a note that belongs to another issue that the user doesn’t have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip.
Impact
Disclosure of the following information:
- existence of the note
- note author name
- note creation timestamp
- issue id the note belongs to
Patches
See PR https://github.com/mantisbt/mantisbt/pull/2000
Workarounds
None
References
https://mantisbt.org/bugs/view.php?id=34434
Skip to content
Navigation Menu
Actions
Automate any workflow
Packages
Host and manage packages
Security
Find and fix vulnerabilities
Codespaces
Instant dev environments
Copilot
Write better code with AI
Code review
Manage code changes
Issues
Plan and track work
Discussions
Collaborate outside of code
GitHub Sponsors
Fund open source developers
* The ReadME Project
GitHub community articles
- Pricing
Provide feedback
Saved searches****Use saved searches to filter your results more quickly
Sign up
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-34080
MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Moderate severity GitHub Reviewed Published May 12, 2024 in mantisbt/mantisbt • Updated May 13, 2024
Package
composer mantisbt/mantisbt (Composer)
Affected versions
< 2.26.2
Description
Published to the GitHub Advisory Database
May 13, 2024
Last updated
May 13, 2024