CVE-2023-22476: MantisBT may expose private issues' summaries to unauthorized users

February 23, 2023

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the Summary field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted bug_arr[] parameter in bug_actiongroup_ext.php. This issue is fixed in version 2.25.6. There are no workarounds.

References

github.com/advisories/GHSA-hf4x-6h87-hm79
github.com/mantisbt/mantisbt/security/advisories/GHSA-hf4x-6h87-hm79
mantisbt.org/bugs/view.php?id=31086

Detect and mitigate CVE-2023-22476 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →