GitHub Advisoryadvisory · Packagist

GHSA-252r-f55f-ff34 MantisBT allows arbitrary password reset

HIGH Published 2022-05-13 Modified 2025-04-22 Official page ↗
Aliases
CVE-2017-7615
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-640
Reviewed
2025-04-22

Affected packages

• Packagist mantisbt/mantisbt: >= 1.3.0-rc.2, < 1.3.10 → fixed in 1.3.10 • Packagist mantisbt/mantisbt: >= 2.0.0, < 2.2.4 → fixed in 2.2.4 • Packagist mantisbt/mantisbt: >= 2.3.0, < 2.3.1 → fixed in 2.3.1

Description

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

Related

Alias · CVE (1)

  • CVE-2017-7615 MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. vulnerability

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References