Description
The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/bid/52313 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html ↗
- http://www.debian.org/security/2012/dsa-2500 ↗
- http://security.gentoo.org/glsa/glsa-201211-01.xml ↗
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 ↗
- http://secunia.com/advisories/49572 ↗
- http://secunia.com/advisories/51199 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html ↗
- https://github.com/mantisbt/mantisbt/commit/eb803ed02105fc919cf5f789e939f2b824162927 ↗
- http://www.openwall.com/lists/oss-security/2012/03/06/9 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html ↗
- http://secunia.com/advisories/48258 ↗
- http://www.mantisbt.org/bugs/view.php?id=10124 ↗