GHSA-hf4x-6h87-hm79
MantisBT may expose private issues' summaries to unauthorized users
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | < 2.25.6 | 2.25.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*.
### Patches
The vulnerability has been fixed in MantisBT version 2.25.6.
### Workarounds
None
### Credits
Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.
### References
- https://mantisbt.org/bugs/view.php?id=31086
References
External links from the advisory. They lead to third-party sites.