CVE-2020-28413: MantisBT SQL Injection via mc_project_get_users function
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP.
Other sources
MantisBT SQL Injection via mcprojectgetusers function
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.24.4
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28413?
The severity of CVE-2020-28413 is medium.
How does SQL Injection occur in CVE-2020-28413?
SQL Injection can occur in CVE-2020-28413 through the API SOAP in the parameter "access" of the mc_project_get_users function.
What software versions are affected by CVE-2020-28413?
MantisBT version 2.24.3 is affected by CVE-2020-28413.
How can I fix the SQL Injection vulnerability in CVE-2020-28413?
Upgrade MantisBT to a version that is not affected by CVE-2020-28413.
Where can I find more information about CVE-2020-28413?
You can find more information about CVE-2020-28413 at the following references: [link1](http://packetstormsecurity.com/files/160750/Mantis-Bug-Tracker-2.24.3-SQL-Injection.html), [link2](https://ethicalhcop.medium.com/cve-2020-28413-blind-sql-injection-en-mantis-bug-tracker-2-24-3-api-soap-54238f8e046d).