Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-pgg9-mmcg-8mxp
Advisory ID github_osv/GHSA-pgg9-mmcg-8mxp
Aliases CVE-2020-29605
Summary MantisBT Incorrect Authorization in bug_actiongroup_page.php An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bug_arr[]= in a crafted bug_actiongroup_page.php URL. (The target Issues can have Private view status, or belong to a private Project.)
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-863 Incorrect Authorization
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
https://github.com/mantisbt/mantisbt
https://github.com/mantisbt/mantisbt/commit/9322c8c9f57fb72f3b8b033889a6a09c441d5be0
https://mantisbt.org/bugs/view.php?id=27357
https://mantisbt.org/bugs/view.php?id=27727
CVE-2020-29605 https://nvd.nist.gov/vuln/detail/CVE-2020-29605
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.