CVEvulnerability

CVE-2018-9839

6.5 MEDIUM Published 2019-06-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-06-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-20

Description

An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).

Affected configurations

• mantisbt mantisbt (<= 1.3.14) • mantisbt mantisbt 2.0.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References