CVE-2024-45792

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/mantisbt/mantisbt/commit/ef0f820284032350cc20a39ff9cb2010d5463b41
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7r
https://mantisbt.org/bugs/view.php?id=34640

Configurations

No configuration.

History

04 Oct 2024, 13:51

Type	Values Removed	Values Added
Summary		(es) Mantis Bug Tracker (MantisBT) es un rastreador de errores de código abierto. Mediante una solicitud POST manipulada, un usuario registrado sin privilegios puede recuperar información sobre los perfiles personales del sistema de otros usuarios. Esta vulnerabilidad se solucionó en la versión 2.26.4.

30 Sep 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-30 15:15

Updated : 2024-10-04 13:51

NVD link : CVE-2024-45792

Mitre link : CVE-2024-45792

CVE.ORG link : CVE-2024-45792

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2024-45792", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 5.3, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "LOW", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-09-30T15:15:05.830", "references": [{"url": "https://github.com/mantisbt/mantisbt/commit/ef0f820284032350cc20a39ff9cb2010d5463b41", "source": "security-advisories@github.com"}, {"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7r", "source": "security-advisories@github.com"}, {"url": "https://mantisbt.org/bugs/view.php?id=34640", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4."}, {"lang": "es", "value": "Mantis Bug Tracker (MantisBT) es un rastreador de errores de c\u00f3digo abierto. Mediante una solicitud POST manipulada, un usuario registrado sin privilegios puede recuperar informaci\u00f3n sobre los perfiles personales del sistema de otros usuarios. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 2.26.4."}], "lastModified": "2024-10-04T13:51:25.567", "sourceIdentifier": "security-advisories@github.com"}