CVE-2024-45792 MEDIUM

CVE-2024-45792: MantisBT vulnerable to information disclosure with user profiles

Vendor Mantisbt
Product mantisbt
Weakness CWE-200 · Info exposure
Published September 30, 2024
Last update September 30, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.

Key dates

02Disclosure timeline

September 30, 2024 CVE published
September 30, 2024 Record updated