MantisBT vulnerable to information disclosure with user profiles

MEDIUM 6.5CVE-2024-45792 · GHSA-h5q3-fjp4-2x7r · Published 30/09/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.26.4`	`2.26.4`
mantisbt mantisbt	`< 2.26.4`	`2.26.4`

Description

Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles.

Impact

Disclosure of private system profiles: Platform, OS, OS version, Description.

Patches

https://github.com/mantisbt/mantisbt/commit/56bbd02dc1fb33a8de5898fd17dc3d698c847f55

Workarounds

None

References

https://mantisbt.org/bugs/view.php?id=34640

NVD description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.

References

mantisbt/mantisbt security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-45792 · ADVISORY
mantisbt/mantisbt commit 56bbd02 · WEB
mantisbt/mantisbt commit ef0f820 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free