MantisBT unauthorized users able to access private files
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-25781US | medium4.3OT erhöht | — | ||
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments l… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://github.com/mantisbt/mantisbt/commit/5595c90f11c48164331a20bb9c66098980516e93WEB
- http://github.com/mantisbt/mantisbt/commit/9de20c09e5a557e57159a61657ce62f1a4f578feWEB
- https://github.com/mantisbt/mantisbtPACKAGE
- https://mantisbt.org/bugs/view.php?id=27039WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-25781ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan