Description (CNA)
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| mantisbt / mantisbt | affected < 2.28.2 |
CWE
CWE-284
References
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc
- https://github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206
- https://mantisbt.org/bugs/view.php?id=36976
ADP enrichment
No English description supplied.
No references supplied.