MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the
    registration and password reset process allows an attacker to reset another user's password and takeover
    their account, if the victim has an incomplete request pending. The exploit is only possible while the
    verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened,
    and the user did not complete the process by updating their password. A brute-force attack calling
    account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker
    full access to the compromised account, including sensitive information and functionalities associated
    with the account, the extent of which depends on its privileges and the data it has access to. Version
    2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the
    verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in
    `constants_inc.php`). (CVE-2024-34077)

According to its version number, the MantisBT application hosted on the remote web server is prior to 2.26.2. It is, therefore, affected by the following vulnerabilities :

  - Insufficient access control in the registration and password reset process allows an attacker to reset another     user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only     possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has     been opened, and the user did not complete the process by updating their password. (CVE-2024-34077)

  - If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets     hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available     via the link, link label, and tooltip. (CVE-2024-34080)

  - Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve     execution of arbitrary JavaScript when resolving or closing issues belonging to a project linking said custom field,     or viewing or printing issues when the custom field is displayed as a column. (CVE-2024-34081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413008	SCA: security update for mantisbt/mantisbt (GHSA-93x3-m7pw-ppqm)	Tenable Cloud Security	SCA Checks	high
413008	SCA: security update for mantisbt/mantisbt (GHSA-93x3-m7pw-ppqm)	Tenable Self-Hosted Container Security	SCA Checks	high
197939	MantisBT < 2.26.2 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-34077

high

Tenable Plugins

high

high

high