Published: 29/06/2012 Updated: 12/01/2021

CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9

VMScore: 320

Vector: AV:N/AC:H/Au:S/C:N/I:P/A:P

The SOAP API in MantisBT prior to 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mantisbt mantisbt 1.2.0
mantisbt mantisbt 1.2.5
mantisbt mantisbt 1.1.0
mantisbt mantisbt 1.1.5
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.4
mantisbt mantisbt 1.0.5
mantisbt mantisbt 0.19.1
mantisbt mantisbt 0.19.2
mantisbt mantisbt 1.2.1
mantisbt mantisbt 1.1.1
mantisbt mantisbt 1.1.3
mantisbt mantisbt 1.1.8
mantisbt mantisbt 1.0.3
mantisbt mantisbt 1.0.8
mantisbt mantisbt 0.19.0
mantisbt mantisbt 0.19.4
mantisbt mantisbt 0.19.3
mantisbt mantisbt 1.2.3
mantisbt mantisbt 1.2.2
mantisbt mantisbt 1.1.4
mantisbt mantisbt 1.0.9
mantisbt mantisbt 1.0.7
mantisbt mantisbt
mantisbt mantisbt 1.2.7
mantisbt mantisbt 1.2.4
mantisbt mantisbt 1.2.6
mantisbt mantisbt 1.1.2
mantisbt mantisbt 1.1.9
mantisbt mantisbt 1.1.6
mantisbt mantisbt 1.1.7
mantisbt mantisbt 1.0.2
mantisbt mantisbt 1.0.1
mantisbt mantisbt 1.0.6
mantisbt mantisbt 0.18.0
mantisbt mantisbt 0.19.5

Several vulnerabilities were discovered in Mantis, an issue tracking system CVE-2012-1118 Mantis installation in which the private_bug_view_threshold configuration option has been set to an array value do not properly enforce bug viewing restrictions CVE-2012-1119 Copy/clone bug report actions fail to leave an audit trail CVE-2012-1120 The ...

CWE-264 http://secunia.com/advisories/48258 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=13656 http://www.openwall.com/lists/oss-security/2012/03/06/9 http://secunia.com/advisories/49572 http://www.debian.org/security/2012/dsa-2500 https://github.com/mantisbt/mantisbt/commit/df7782a65e96aa1c9639a7625a658102134c7fe0 http://security.gentoo.org/glsa/glsa-201211-01.xml http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html http://www.securityfocus.com/bid/52313 http://secunia.com/advisories/51199 https://nvd.nist.gov https://www.debian.org/security/./dsa-2500

CVE-2012-1120

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect