GHSA-v642-mh27-8j6m

MantisBT may disclose project names to unauthorized users

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-44394

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	mantisbt/mantisbt	< 2.25.8	2.25.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. ### Patches The vulnerability has been fixed in MantisBT version 2.25.8 (https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1). ### Workarounds Disable wiki integration ( `$g_wiki_enable = OFF;`) ### References - https://mantisbt.org/bugs/view.php?id=32981

References

External links from the advisory. They lead to third-party sites.

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v642-mh27-8j6m web
https://nvd.nist.gov/vuln/detail/CVE-2023-44394 advisory
https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1 web
https://github.com/mantisbt/mantisbt package
https://mantisbt.org/bugs/view.php?id=32981 web