CVE-2012-2691: High severity MantisBT mantisbt vulnerability
Published Jun 17, 2012
·Updated
The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
Affected Software
60 affected components
MantisBT mantisbt<=1.2.10
MantisBT mantisbt=0.18.0
MantisBT mantisbt=0.19.0
MantisBT mantisbt=0.19.0-a1
MantisBT mantisbt=0.19.0-a2
MantisBT mantisbt=0.19.0-rc1
MantisBT mantisbt=0.19.1
MantisBT mantisbt=0.19.2
MantisBT mantisbt=0.19.3
MantisBT mantisbt=0.19.4
MantisBT mantisbt=0.19.5
MantisBT mantisbt=1.0.0
MantisBT mantisbt=1.0.0-a1
MantisBT mantisbt=1.0.0-a2
MantisBT mantisbt=1.0.0-a3
MantisBT mantisbt=1.0.0-rc1
MantisBT mantisbt=1.0.0-rc2
MantisBT mantisbt=1.0.0-rc3
MantisBT mantisbt=1.0.0-rc4
MantisBT mantisbt=1.0.0-rc5
MantisBT mantisbt=1.0.1
MantisBT mantisbt=1.0.2
MantisBT mantisbt=1.0.3
MantisBT mantisbt=1.0.4
MantisBT mantisbt=1.0.5
MantisBT mantisbt=1.0.7
MantisBT mantisbt=1.0.8
MantisBT mantisbt=1.0.9
MantisBT mantisbt=1.1.0
MantisBT mantisbt=1.1.0-a1
MantisBT mantisbt=1.1.0-a2
MantisBT mantisbt=1.1.0-a3
MantisBT mantisbt=1.1.0-a4
MantisBT mantisbt=1.1.0-rc1
MantisBT mantisbt=1.1.0-rc2
MantisBT mantisbt=1.1.0-rc3
MantisBT mantisbt=1.1.1
MantisBT mantisbt=1.1.2
MantisBT mantisbt=1.1.3
MantisBT mantisbt=1.1.4
MantisBT mantisbt=1.1.5
MantisBT mantisbt=1.1.6
MantisBT mantisbt=1.1.7
MantisBT mantisbt=1.1.8
MantisBT mantisbt=1.1.9
MantisBT mantisbt=1.2.0
MantisBT mantisbt=1.2.0-alpha1
MantisBT mantisbt=1.2.0-alpha2
MantisBT mantisbt=1.2.0-alpha3
MantisBT mantisbt=1.2.0-rc1
MantisBT mantisbt=1.2.0-rc2
MantisBT mantisbt=1.2.1
MantisBT mantisbt=1.2.2
MantisBT mantisbt=1.2.3
MantisBT mantisbt=1.2.4
MantisBT mantisbt=1.2.5
MantisBT mantisbt=1.2.6
MantisBT mantisbt=1.2.7
MantisBT mantisbt=1.2.8
MantisBT mantisbt=1.2.9
Remediation
Event History
Jun 17, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2691?
The severity of CVE-2012-2691 is categorized as a moderate risk vulnerability.
2
How do I fix CVE-2012-2691?
To fix CVE-2012-2691, upgrade MantisBT to version 1.2.11 or later.
3
What versions of MantisBT are affected by CVE-2012-2691?
CVE-2012-2691 affects all versions of MantisBT prior to 1.2.11, including versions 0.18.0 through to 1.2.10.
4
What type of attack does CVE-2012-2691 allow?
CVE-2012-2691 allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
5
Is there a workaround for CVE-2012-2691 if I cannot upgrade?
A workaround for CVE-2012-2691 involves temporarily removing SOAP API access until an upgrade can be completed.