CVE-2020-36192

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php page, as well as on the list.php page (a pop-up on the Affected Issues id hyperlink). Additionally, if the attacker has "Update threshold" in the plugin's configuration (set to the "updater" access level by default), then they can link any Issue to a Changeset by entering the Issue's Id, even if they do not have access to it.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/mantisbt-plugins/source-integration/issues/344	Exploit Third Party Advisory
https://github.com/mantisbt-plugins/source-integration/issues/344	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mantisbt:source_integration:*:*:*:*:*:mantisbt:*:*

History

21 Nov 2024, 05:28

Type	Values Removed	Values Added
References	~~() https://github.com/mantisbt-plugins/source-integration/issues/344 - Exploit, Third Party Advisory~~	() https://github.com/mantisbt-plugins/source-integration/issues/344 - Exploit, Third Party Advisory

Information

Published : 2021-01-18 20:15

Updated : 2024-11-21 05:28

NVD link : CVE-2020-36192

Mitre link : CVE-2020-36192

CVE.ORG link : CVE-2020-36192

JSON object : View

Products Affected

mantisbt

source_integration

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-36192", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-01-18T20:15:12.603", "references": [{"url": "https://github.com/mantisbt-plugins/source-integration/issues/344", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/mantisbt-plugins/source-integration/issues/344", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php page, as well as on the list.php page (a pop-up on the Affected Issues id hyperlink). Additionally, if the attacker has \"Update threshold\" in the plugin's configuration (set to the \"updater\" access level by default), then they can link any Issue to a Changeset by entering the Issue's Id, even if they do not have access to it."}, {"lang": "es", "value": "Se detect\u00f3 un problema en el plugin Source Integration versiones anteriores a 2.4.1 para MantisBT. Un atacante puede conseguir acceso al campo Summary de Problemas privados (ya sea marcados como privados o como parte de un proyecto privado), si est\u00e1n adjuntos a un Changeset existente. La informaci\u00f3n est\u00e1 visible en la p\u00e1gina view.php, as\u00ed como en la p\u00e1gina list.php (una ventana emergente en el hiperv\u00ednculo de identificaci\u00f3n de problemas afectados). Adem\u00e1s, si el atacante tiene \"Update threshold\" en la configuraci\u00f3n del plugin (establecido en el nivel de acceso de \"updater\" por defecto), entonces puede vincular cualquier Problema a un Changeset al ingresar el ID del problema, inclusive si no tiene acceso a eso"}], "lastModified": "2024-11-21T05:28:58.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mantisbt:source_integration:*:*:*:*:*:mantisbt:*:*", "vulnerable": true, "matchCriteriaId": "6547E2F7-C992-4AB0-A743-35868E91CD68", "versionEndExcluding": "2.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}