Date: Thu, 25 Jun 2015 01:04:32 +0200 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: CVE Request: Information disclosure in MantisBT Greetings, Please assign a CVE ID for the following issue. Description: In MantisBT, the "Project Documentation" feature can be used to attach files to a project. When this feature is enabled ($g_enable_project_documentation = ON) and the threshold to view these files is left to its default value ($g_view_proj_doc_threshold = ANYBODY), any registered user in the system can download every such attachment, including those which are linked to private projects to which the user does not have access. This can be achieved by calling the download script directly, and specifying the ID of the file to download, e.g. http://example.com/mantis/file_download.php?file_id=123&type=doc Affected versions: - <= 1.2.19 - <= 1.3.0-beta.2 Fixed in versions: - 1.2.20 (not yet released) - 1.3.0-rc1 (not yet released) Patch: See Github  Credits: The issue was discovered by Werner Karl and fixed by Damien Regad (MantisBT Developer). References: Further details available in our issue tracker  Best regards, D. Regad MantisBT Developer http://www.mantisbt.org  http://github.com/mantisbt/mantisbt/commit/f39cf525 (1.2.x) http://github.com/mantisbt/mantisbt/commit/a4be76d6 (1.3.x)  https://mantisbt.org/bugs/view.php?id=19873
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ