The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.
The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.
Cross-site scripting (XSS) vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303.
MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.
bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access restrictions and move bug reports to a different project.
A flaw was found in the way that the Mantis BTS handled attachments and MIME types. A user could upload an HTML file renamed to a .gif and Mantis would calculate the actual MIME type of the file as text/html. A user tricked into thinking they were clicking a .gif attachment would instead have the full HTML file rendered in the browser, rather than having it treated as a downloadable file or displayed in plain text.
References:
http://www.mantisbt.org/bugs/view.php?id=11952 http://www.mantisbt.org/blog/?p=113
This was corrected in upstream version 1.2.2 and affects current Fedora 12, 13, rawhide, and EPEL5.