Published: 29/06/2012 Updated: 12/01/2021

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT prior to 1.2.9 allows remote malicious users to bypass authentication via a null password.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mantisbt mantisbt 1.2.0
mantisbt mantisbt 1.1.1
mantisbt mantisbt 1.1.3
mantisbt mantisbt 1.1.8
mantisbt mantisbt 1.1.0
mantisbt mantisbt 1.0.0
mantisbt mantisbt 1.0.3
mantisbt mantisbt 1.0.8
mantisbt mantisbt 0.19.4
mantisbt mantisbt 0.19.3
mantisbt mantisbt 1.2.5
mantisbt mantisbt 1.1.5
mantisbt mantisbt 1.0.4
mantisbt mantisbt 1.0.5
mantisbt mantisbt 0.19.0
mantisbt mantisbt 0.19.1
mantisbt mantisbt 0.19.2
mantisbt mantisbt
mantisbt mantisbt 1.2.1
mantisbt mantisbt 1.2.4
mantisbt mantisbt 1.2.6
mantisbt mantisbt 1.1.2
mantisbt mantisbt 1.1.9
mantisbt mantisbt 1.1.6
mantisbt mantisbt 1.0.2
mantisbt mantisbt 1.0.1
mantisbt mantisbt 1.0.6
mantisbt mantisbt 0.19.5
mantisbt mantisbt 1.2.7
mantisbt mantisbt 1.2.3
mantisbt mantisbt 1.2.2
mantisbt mantisbt 1.1.7
mantisbt mantisbt 1.1.4
mantisbt mantisbt 1.0.9
mantisbt mantisbt 1.0.7
mantisbt mantisbt 0.18.0

Several vulnerabilities were discovered in Mantis, an issue tracking system CVE-2012-1118 Mantis installation in which the private_bug_view_threshold configuration option has been set to an array value do not properly enforce bug viewing restrictions CVE-2012-1119 Copy/clone bug report actions fail to leave an audit trail CVE-2012-1120 The ...

CWE-287 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://secunia.com/advisories/49572 https://github.com/mantisbt/mantisbt/commit/f5106be52cf6aa72c521f388e4abb5f0de1f1d7f http://secunia.com/advisories/48258 http://www.mantisbt.org/bugs/view.php?id=13901 http://www.debian.org/security/2012/dsa-2500 http://www.openwall.com/lists/oss-security/2012/03/06/9 http://security.gentoo.org/glsa/glsa-201211-01.xml http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html http://www.securityfocus.com/bid/52313 http://secunia.com/advisories/51199 https://nvd.nist.gov https://www.debian.org/security/./dsa-2500

CVE-2012-1123

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect