MantisBT up to 1.3.14/2.0.0 Cloning bug_report_page.php m_id input validation

Summaryinfo

A vulnerability classified as problematic has been found in MantisBT up to 1.3.14/2.0.0. The impacted element is an unknown function of the file bug_report_page.php of the component Cloning Handler. The manipulation of the argument m_id leads to input validation. This vulnerability is documented as CVE-2018-9839. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in MantisBT up to 1.3.14/2.0.0 (Bug Tracking Software) and classified as problematic. This issue affects some unknown processing of the file bug_report_page.php of the component Cloning Handler. The manipulation of the argument m_id with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality. The summary by CVE is:

An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).

The weakness was released 06/06/2019 (GitHub Repository). The advisory is shared at github.com. The identification of this vulnerability is CVE-2018-9839 since 04/07/2018. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details are known, but no exploit is available.

By approaching the search of inurl:bug_report_page.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Bug Tracking Software

Name

• MantisBT

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 2.0

License

• open-source

Website

• Product: https://github.com/mantisbt/mantisbt/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion