oss-security - CVE Request: Information disclosure in MantisBT

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <mmfd21$39r$1@ger.gmane.org>
Date: Thu, 25 Jun 2015 01:04:32 +0200
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: CVE Request: Information disclosure in MantisBT

Greetings,

Please assign a CVE ID for the following issue.

Description:

In MantisBT, the "Project Documentation" feature can be used to attach 
files to a project.

When this feature is enabled ($g_enable_project_documentation = ON) and 
the threshold to view these files is left to its default value 
($g_view_proj_doc_threshold = ANYBODY), any registered user in the 
system can download every such attachment, including those which are 
linked to private projects to which the user does not have access.

This can be achieved by calling the download script directly, and 
specifying the ID of the file to download, e.g.

http://example.com/mantis/file_download.php?file_id=123&type=doc

Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.2

Fixed in versions:
- 1.2.20 (not yet released)
- 1.3.0-rc1 (not yet released)

Patch:
See Github [1]

Credits:
The issue was discovered by Werner Karl and fixed by Damien Regad
(MantisBT Developer).

References:
Further details available in our issue tracker [2]

Best regards,
D. Regad
MantisBT Developer
http://www.mantisbt.org

[1] http://github.com/mantisbt/mantisbt/commit/f39cf525 (1.2.x)
     http://github.com/mantisbt/mantisbt/commit/a4be76d6 (1.3.x)
[2] https://mantisbt.org/bugs/view.php?id=19873

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.