References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Known Affected Software Configurations Switch to CPE 2.2

Change History

OR
          *cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* versions up to (excluding) 2.27.2

GitHub, Inc.: https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e Types: Patch

GitHub, Inc.: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr Types: Issue Tracking, Vendor Advisory

GitHub, Inc.: https://mantisbt.org/bugs/view.php?id=36005 Types: Exploit, Issue Tracking, Vendor Advisory

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-201

CWE-354

https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr

https://mantisbt.org/bugs/view.php?id=36005