| Package | Affected versions | Patched versions |
|---|---|---|
| mantisbt/mantisbt | ≥ 2.8.0, < 2.28.4 | 2.28.4 |
A MantisBT user having $g_update_bug_threshold (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the $g_set_status_threshold config is set to a higher level (DEVELOPER by default).
Unauthorized change in Issue workflow.
https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4
None
Mamdouh Mahfouz (@mamdouhmahfouz)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free