high7.5
CVE-2020-35849
MantisBT Incorrect Authorization for bug_revision_view_page.php check
Impact
An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnote_id parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mantisbt/mantisbt | <= 2.24.3 | 2.24.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mantisbt | Mantisbt | before 2.24.4 |