CVE-2025-62520
MantisBT unauthorized disclosure of private project column configuration
Résumé
MantisBT unauthorized disclosure of private project column configuration
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web mantisbt.org