CVE-2015-5059: Infoleak
In MantisBT, the "Project Documentation" feature can be used to attach files to a project. When this feature is enabled ($genableprojectdocumentation = ON) and the threshold to view these files is left to its default value ($gviewprojdocthreshold = ANYBODY), any registered user in the system can download every such attachment, including those which are linked to private projects to which the user does not have access. This can be achieved by calling the download script directly, and specifying the ID of the file to download, e.g.
http://example.com/mantis/filedownload.php?fileid=123&type=doc
Affected versions: - <= 1.2.19 - <= 1.3.0-beta.2
Originally reported on http://seclists.org/oss-sec/2015/q2/791 Upstream patches: - 1.2.x: http://github.com/mantisbt/mantisbt/commit/f39cf525 - 1.3.x: http://github.com/mantisbt/mantisbt/commit/a4be76d6
Other sources
The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($gviewprojdocthreshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the fileid parameter to filedownload.php.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5059?
CVE-2015-5059 is classified as a medium severity vulnerability due to its potential to allow unauthorized access to project documentation files for registered users.
How do I fix CVE-2015-5059?
To fix CVE-2015-5059, upgrade to MantisBT versions 1.2.20 or 1.3.0 or later.
Which versions of MantisBT are affected by CVE-2015-5059?
CVE-2015-5059 affects MantisBT versions up to and including 1.2.19.
What functionality is exploited in CVE-2015-5059?
CVE-2015-5059 exploits the Project Documentation feature allowing unauthorized access to files if not configured properly.
Who is impacted by CVE-2015-5059?
Any registered user in the MantisBT system can be impacted by CVE-2015-5059 if default configuration values are used.