Vulnerability in Mantisbt

CVE-2012-2691

The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.

EPSS: 0.038 (89.0th percentile) — read the EPSS interpretation.

Affected products

  • Mantisbt — versions 0.18.0, 0.19.0, 0.19.1
  • N/a — versions n/a

Weakness classification (CWE)

References