Vulnerability in Mantisbt

CVE-2012-1118

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.

EPSS: 0.031 (86.3th percentile) — read the EPSS interpretation.

Affected products

  • Mantisbt — versions 0.18.0, 0.19.0, 0.19.0a1
  • N/a — versions n/a

Weakness classification (CWE)

References