CVE-2012-2691

The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
References
Link Resource
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
http://secunia.com/advisories/49414 Vendor Advisory
http://secunia.com/advisories/51199
http://security.gentoo.org/glsa/glsa-201211-01.xml
http://www.mantisbt.org/bugs/changelog_page.php?version_id=148
http://www.mantisbt.org/bugs/view.php?id=14340
http://www.openwall.com/lists/oss-security/2012/06/09/1
http://www.openwall.com/lists/oss-security/2012/06/11/6
http://www.securityfocus.com/bid/53907
http://www.securityfocus.com/bid/56467
https://exchange.xforce.ibmcloud.com/vulnerabilities/76180
https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0 Exploit Patch
https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e Exploit Patch
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
http://secunia.com/advisories/49414 Vendor Advisory
http://secunia.com/advisories/51199
http://security.gentoo.org/glsa/glsa-201211-01.xml
http://www.mantisbt.org/bugs/changelog_page.php?version_id=148
http://www.mantisbt.org/bugs/view.php?id=14340
http://www.openwall.com/lists/oss-security/2012/06/09/1
http://www.openwall.com/lists/oss-security/2012/06/11/6
http://www.securityfocus.com/bid/53907
http://www.securityfocus.com/bid/56467
https://exchange.xforce.ibmcloud.com/vulnerabilities/76180
https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0 Exploit Patch
https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e Exploit Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.18.0:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.0:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.0:a1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.0:a2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.1:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.2:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.3:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.4:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:0.19.5:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:a1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:a2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:a3:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc4:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc5:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:a1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:a2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:a3:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:a4:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.0:rc3:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.7:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.8:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.1.9:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.7:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.8:*:*:*:*:*:*:*
cpe:2.3:a:mantisbt:mantisbt:1.2.9:*:*:*:*:*:*:*

History

21 Nov 2024, 01:39

Type Values Removed Values Added
References () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html - () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html -
References () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html - () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html -
References () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html - () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html -
References () http://secunia.com/advisories/49414 - Vendor Advisory () http://secunia.com/advisories/49414 - Vendor Advisory
References () http://secunia.com/advisories/51199 - () http://secunia.com/advisories/51199 -
References () http://security.gentoo.org/glsa/glsa-201211-01.xml - () http://security.gentoo.org/glsa/glsa-201211-01.xml -
References () http://www.mantisbt.org/bugs/changelog_page.php?version_id=148 - () http://www.mantisbt.org/bugs/changelog_page.php?version_id=148 -
References () http://www.mantisbt.org/bugs/view.php?id=14340 - () http://www.mantisbt.org/bugs/view.php?id=14340 -
References () http://www.openwall.com/lists/oss-security/2012/06/09/1 - () http://www.openwall.com/lists/oss-security/2012/06/09/1 -
References () http://www.openwall.com/lists/oss-security/2012/06/11/6 - () http://www.openwall.com/lists/oss-security/2012/06/11/6 -
References () http://www.securityfocus.com/bid/53907 - () http://www.securityfocus.com/bid/53907 -
References () http://www.securityfocus.com/bid/56467 - () http://www.securityfocus.com/bid/56467 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/76180 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/76180 -
References () https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0 - Exploit, Patch () https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0 - Exploit, Patch
References () https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e - Exploit, Patch () https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e - Exploit, Patch

Information

Published : 2012-06-17 03:41

Updated : 2024-11-21 01:39


NVD link : CVE-2012-2691

Mitre link : CVE-2012-2691

CVE.ORG link : CVE-2012-2691


JSON object : View

Products Affected

mantisbt

  • mantisbt
CWE
CWE-264

Permissions, Privileges, and Access Controls