MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs
    to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link
    gives an access denied error as expected, yet some information remains available via the link, link label,
    and tooltip. This can result in disclosure of the existence of the note, the note author name, the note
    creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-34080)

According to its version number, the MantisBT application hosted on the remote web server is prior to 2.26.2. It is, therefore, affected by the following vulnerabilities :

  - Insufficient access control in the registration and password reset process allows an attacker to reset another     user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only     possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has     been opened, and the user did not complete the process by updating their password. (CVE-2024-34077)

  - If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets     hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available     via the link, link label, and tooltip. (CVE-2024-34080)

  - Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve     execution of arbitrary JavaScript when resolving or closing issues belonging to a project linking said custom field,     or viewing or printing issues when the custom field is displayed as a column. (CVE-2024-34081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413171	SCA: security update for mantisbt/mantisbt (GHSA-99jc-wqmr-ff2q)	Tenable Cloud Security	SCA Checks	medium
413171	SCA: security update for mantisbt/mantisbt (GHSA-99jc-wqmr-ff2q)	Tenable Self-Hosted Container Security	SCA Checks	medium
197939	MantisBT < 2.26.2 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-34080

medium

Tenable Plugins

medium

medium

high