CVE-2015-5059: Infoleak
First published: Tue Jun 30 2015(Updated: )
In MantisBT, the "Project Documentation" feature can be used to attach files to a project. When this feature is enabled ($g_enable_project_documentation = ON) and the threshold to view these files is left to its default value ($g_view_proj_doc_threshold = ANYBODY), any registered user in the system can download every such attachment, including those which are linked to private projects to which the user does not have access. This can be achieved by calling the download script directly, and specifying the ID of the file to download, e.g. <a href="http://example.com/mantis/file_download.php?file_id=123&type=doc">http://example.com/mantis/file_download.php?file_id=123&type=doc</a> Affected versions: - <= 1.2.19 - <= 1.3.0-beta.2 Originally reported on <a href="http://seclists.org/oss-sec/2015/q2/791">http://seclists.org/oss-sec/2015/q2/791</a> Upstream patches: - 1.2.x: <a href="http://github.com/mantisbt/mantisbt/commit/f39cf525">http://github.com/mantisbt/mantisbt/commit/f39cf525</a> - 1.3.x: <a href="http://github.com/mantisbt/mantisbt/commit/a4be76d6">http://github.com/mantisbt/mantisbt/commit/a4be76d6</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/MantisBT | <1.2.20 | 1.2.20 |
| redhat/MantisBT | <1.3.0 | 1.3.0 |
| Mantisbt Mantisbt | <=1.2.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163191.html
- http://www.openwall.com/lists/oss-security/2015/06/25/3
- http://www.openwall.com/lists/oss-security/2015/06/25/4
- http://www.securityfocus.com/bid/75414
- https://bugzilla.redhat.com/show_bug.cgi?id=1237199
- https://github.com/mantisbt/mantisbt/commit/a4be76d6e5c4939545d84712c79d3f8f4a108c4f
- https://github.com/mantisbt/mantisbt/commit/f39cf5251953b468e9d921e1cf2aca3abdb00772
- http://example.com/mantis/file_download.php?file_id=123&type=doc
- http://seclists.org/oss-sec/2015/q2/791
- http://github.com/mantisbt/mantisbt/commit/f39cf525
- http://github.com/mantisbt/mantisbt/commit/a4be76d6
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1237200
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1237201
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5059
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- vendor/mantisbt
- canonical/mantisbt mantisbt
- version/mantisbt mantisbt/1.2.19
- package-manager/redhat