CVE-2020-29603: MantisBT Insecure Storage in manage_proj_edit_page.php
In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them.
Other sources
MantisBT Insecure Storage in manageprojeditpage.php
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.24.4
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-29603.
What is the severity of CVE-2020-29603?
The severity of CVE-2020-29603 is medium with a CVSS score of 4.3.
What is the affected software?
The affected software is MantisBT before version 2.24.4.
How can an unprivileged logged-in user exploit CVE-2020-29603?
An unprivileged logged-in user can retrieve Private Projects' names via the 'manage_proj_edit_page.php' project_id parameter without having access to them.
Is Microsoft Windows affected by CVE-2020-29603?
No, Microsoft Windows is not affected by CVE-2020-29603.