National Cyber Awareness System

Vulnerability Summary for CVE-2012-2691

Overview

The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e

Type: Patch Information; Exploit

Hyperlink:https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e

External Source: CONFIRM

Name: https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0

Type: Patch Information; Exploit

Hyperlink:https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0

External Source: XF

Name: mantisbt-soapapi-sec-bypass(76180)

Hyperlink:http://xforce.iss.net/xforce/xfdb/76180

External Source: BID

Name: 56467

Hyperlink:http://www.securityfocus.com/bid/56467

External Source: BID

Name: 53907

Hyperlink:http://www.securityfocus.com/bid/53907

External Source: MLIST

Name: [oss-security] 20120611 Re: CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11

Hyperlink:http://www.openwall.com/lists/oss-security/2012/06/11/6

External Source: MLIST

Name: [oss-security] 20120609 CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11

Hyperlink:http://www.openwall.com/lists/oss-security/2012/06/09/1

External Source: CONFIRM

Name: http://www.mantisbt.org/bugs/view.php?id=14340

Hyperlink:http://www.mantisbt.org/bugs/view.php?id=14340

External Source: CONFIRM

Name: http://www.mantisbt.org/bugs/changelog_page.php?version_id=148

Hyperlink:http://www.mantisbt.org/bugs/changelog_page.php?version_id=148

External Source: SECUNIA

Name: 49414

Type: Advisory

Hyperlink:http://secunia.com/advisories/49414