cve-2024-34080
Vulnerability from cvelistv5
Published
2024-05-13 15:35
Modified
2024-08-02 02:42
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.
References
security-advisories@github.comhttps://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226
security-advisories@github.comhttps://github.com/mantisbt/mantisbt/pull/2000
security-advisories@github.comhttps://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
security-advisories@github.comhttps://mantisbt.org/bugs/view.php?id=34434
af854a3a-2127-422b-91ae-364da2661108https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226
af854a3a-2127-422b-91ae-364da2661108https://github.com/mantisbt/mantisbt/pull/2000
af854a3a-2127-422b-91ae-364da2661108https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
af854a3a-2127-422b-91ae-364da2661108https://mantisbt.org/bugs/view.php?id=34434
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mantisbt",
            "vendor": "mantisbt",
            "versions": [
              {
                "lessThan": "2.26.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-13T18:31:57.581342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T17:59:48.416Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:42:59.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q"
          },
          {
            "name": "https://github.com/mantisbt/mantisbt/pull/2000",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mantisbt/mantisbt/pull/2000"
          },
          {
            "name": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226"
          },
          {
            "name": "https://mantisbt.org/bugs/view.php?id=34434",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mantisbt.org/bugs/view.php?id=34434"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mantisbt",
          "vendor": "mantisbt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.26.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn\u0027t have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-13T15:35:00.399Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q"
        },
        {
          "name": "https://github.com/mantisbt/mantisbt/pull/2000",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mantisbt/mantisbt/pull/2000"
        },
        {
          "name": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226"
        },
        {
          "name": "https://mantisbt.org/bugs/view.php?id=34434",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mantisbt.org/bugs/view.php?id=34434"
        }
      ],
      "source": {
        "advisory": "GHSA-99jc-wqmr-ff2q",
        "discovery": "UNKNOWN"
      },
      "title": "MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-34080",
    "datePublished": "2024-05-13T15:35:00.399Z",
    "dateReserved": "2024-04-30T06:56:33.384Z",
    "dateUpdated": "2024-08-02T02:42:59.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn\u0027t have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.\"}, {\"lang\": \"es\", \"value\": \"MantisBT (Mantis Bug Tracker) es un rastreador de problemas de c\\u00f3digo abierto. Si un problema hace referencia a una nota que pertenece a otro problema al que el usuario no tiene acceso, se crea un hiperv\\u00ednculo. Al hacer clic en el enlace se produce un error de acceso denegado, como se esperaba, pero parte de la informaci\\u00f3n permanece disponible a trav\\u00e9s del enlace, la etiqueta del enlace y la informaci\\u00f3n sobre herramientas. Esto puede dar como resultado la divulgaci\\u00f3n de la existencia de la nota, el nombre del autor de la nota, la marca de tiempo de creaci\\u00f3n de la nota y la identificaci\\u00f3n del problema al que pertenece la nota. La versi\\u00f3n 2.26.2 contiene un parche para el problema. No hay workarounds conocidos disponibles.\"}]",
      "id": "CVE-2024-34080",
      "lastModified": "2024-11-21T09:18:02.957",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-05-14T15:38:29.703",
      "references": "[{\"url\": \"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/mantisbt/mantisbt/pull/2000\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://mantisbt.org/bugs/view.php?id=34434\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/mantisbt/mantisbt/pull/2000\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://mantisbt.org/bugs/view.php?id=34434\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Undergoing Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-34080\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-05-14T15:38:29.703\",\"lastModified\":\"2024-11-21T09:18:02.957\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn\u0027t have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.\"},{\"lang\":\"es\",\"value\":\"MantisBT (Mantis Bug Tracker) es un rastreador de problemas de c\u00f3digo abierto. Si un problema hace referencia a una nota que pertenece a otro problema al que el usuario no tiene acceso, se crea un hiperv\u00ednculo. Al hacer clic en el enlace se produce un error de acceso denegado, como se esperaba, pero parte de la informaci\u00f3n permanece disponible a trav\u00e9s del enlace, la etiqueta del enlace y la informaci\u00f3n sobre herramientas. Esto puede dar como resultado la divulgaci\u00f3n de la existencia de la nota, el nombre del autor de la nota, la marca de tiempo de creaci\u00f3n de la nota y la identificaci\u00f3n del problema al que pertenece la nota. La versi\u00f3n 2.26.2 contiene un parche para el problema. No hay workarounds conocidos disponibles.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mantisbt/mantisbt/pull/2000\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://mantisbt.org/bugs/view.php?id=34434\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/mantisbt/mantisbt/pull/2000\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://mantisbt.org/bugs/view.php?id=34434\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\", \"name\": \"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/mantisbt/mantisbt/pull/2000\", \"name\": \"https://github.com/mantisbt/mantisbt/pull/2000\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\", \"name\": \"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://mantisbt.org/bugs/view.php?id=34434\", \"name\": \"https://mantisbt.org/bugs/view.php?id=34434\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:42:59.815Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-34080\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-13T18:31:57.581342Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*\"], \"vendor\": \"mantisbt\", \"product\": \"mantisbt\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.26.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-13T18:31:13.074Z\"}}], \"cna\": {\"title\": \"MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor\", \"source\": {\"advisory\": \"GHSA-99jc-wqmr-ff2q\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"mantisbt\", \"product\": \"mantisbt\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.26.2\"}]}], \"references\": [{\"url\": \"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\", \"name\": \"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/mantisbt/mantisbt/pull/2000\", \"name\": \"https://github.com/mantisbt/mantisbt/pull/2000\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\", \"name\": \"https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://mantisbt.org/bugs/view.php?id=34434\", \"name\": \"https://mantisbt.org/bugs/view.php?id=34434\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn\u0027t have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-13T15:35:00.399Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-34080\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T02:42:59.815Z\", \"dateReserved\": \"2024-04-30T06:56:33.384Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-05-13T15:35:00.399Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.