SB2025110622 - Multiple vulnerabilities in MantisBT

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-46556)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the lack of server-side validation for note length. A remote user can cause a denial of service condition on the target system.

2) Information disclosure (CVE-ID: CVE-2025-62520)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to insufficient access-level checks. A remote user can retrieve the columns configuration from a private project.

3) Insufficient verification of data authenticity (CVE-ID: CVE-2025-55155)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to lack of verification when changing a user's email address. A remote user can prevent the user from receiving system notifications, leading to information disclosure.

4) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2025-47776)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to PHP type juggling issue. A remote attacker can bypass authentication and gain access to the target system.

Remediation

Install update from vendor's website.

References

• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-r3jf-hm7q-qfw5
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-g582-8vwr-68h2
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4v8w-gg5j-ph37