Permissions, Privileges, and Access Controls in MantisBT - CVE-2012-1121
Published: June 29, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43924
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-1121
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote #AU# to manipulate or delete data.
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.
Affected software
MantisBT
How to mitigate CVE-2012-1121
Install update from vendor's website.
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
- http://secunia.com/advisories/48258
- http://secunia.com/advisories/51199
- http://security.gentoo.org/glsa/glsa-201211-01.xml
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=140
- http://www.mantisbt.org/bugs/view.php?id=13561
- http://www.openwall.com/lists/oss-security/2012/03/06/9
- http://www.securityfocus.com/bid/52313
- https://github.com/mantisbt/mantisbt/commit/9443258724e84cb388aa1865b775beaecd80596d