SB2012062903 - Multiple vulnerabilities in mantisbt.sourceforge.net MantisBT

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012062903

SB2012062903 - Multiple vulnerabilities in mantisbt.sourceforge.net MantisBT

Published: June 29, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012062903
Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-1121)

The vulnerability allows a remote #AU# to manipulate or delete data.

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-1122)

The vulnerability allows a remote #AU# to manipulate or delete data.

bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project.


3) Improper Authentication (CVE-ID: CVE-2012-1123)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.


4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-1118)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.


5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-1119)

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.


6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-1120)

The vulnerability allows a remote #AU# to manipulate or delete data.

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.


Remediation

Install update from vendor's website.

References