CVE-2024-45792
MantisBT vulnerable to information disclosure with user profiles
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
MantisBT vulnerable to information disclosure with user profiles
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.
Reserved 2024-09-09 | Published 2024-09-30 | Updated 2024-09-30 | Assigner GitHub_MCWE-200: Exposure of Sensitive Information to an Unauthorized Actor
github.com/...ntisbt/security/advisories/GHSA-h5q3-fjp4-2x7r
github.com/...ommit/ef0f820284032350cc20a39ff9cb2010d5463b41
mantisbt.org/bugs/view.php?id=34640
Support options
