CVE-2020-29604: MantisBT Missing Authorization access check in bug_actiongroup.php
An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private view status, or belonging to a private Project) via the bugarr[] parameter. This provides full access to potentially confidential information.
Other sources
MantisBT Missing Authorization access check in bugactiongroup.php
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.24.4
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-29604.
What is the severity rating of CVE-2020-29604?
CVE-2020-29604 has a severity rating of medium with a CVSS score of 6.5.
How can an attacker exploit this vulnerability?
An attacker (with rights to create new issues) can exploit this vulnerability by using the COPY group action in bug_actiongroup.php to create a clone of any private issue, including all bugnotes and attachments.
What is the affected software for CVE-2020-29604?
The affected software for CVE-2020-29604 is MantisBT versions before 2.24.4.
Is Microsoft Windows affected by CVE-2020-29604?
No, Microsoft Windows is not affected by CVE-2020-29604.