GitHub Advisoryadvisory · Packagist

GHSA-v642-mh27-8j6m MantisBT may disclose project names to unauthorized users

MEDIUM Published 2023-10-17 Modified 2025-08-11 Official page ↗
Aliases
CVE-2023-44394
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-668
Reviewed
2023-10-17

Affected packages

• Packagist mantisbt/mantisbt: < 2.25.8 → fixed in 2.25.8

Description

Impact Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. Patches The vulnerability has been fixed in MantisBT version 2.25.8 (https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1). Workarounds Disable wiki integration ( `$g_wiki_enable = OFF;`) References • https://mantisbt.org/bugs/view.php?id=32981

Related

Alias · CVE (1)

  • CVE-2023-44394 MantisBT is an open source bug tracker. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References