Permissions, Privileges, and Access Controls in MantisBT - CVE-2012-1121
Published: June 29, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43924
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-1121
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
MantisBT
MantisBT
Software vendor:
mantisbt.sourceforge.net
mantisbt.sourceforge.net
Description
The vulnerability allows a remote #AU# to manipulate or delete data.
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.
Remediation
Install update from vendor's website.
External links
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
- http://secunia.com/advisories/48258
- http://secunia.com/advisories/51199
- http://security.gentoo.org/glsa/glsa-201211-01.xml
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=140
- http://www.mantisbt.org/bugs/view.php?id=13561
- http://www.openwall.com/lists/oss-security/2012/03/06/9
- http://www.securityfocus.com/bid/52313
- https://github.com/mantisbt/mantisbt/commit/9443258724e84cb388aa1865b775beaecd80596d