CVE-2023-44394: Exposure of Sensitive Information to an Unauthorized Actor

October 17, 2023

MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects’ names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit 65c44883f which has been included in release 2.258. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( $g_wiki_enable = OFF;).

References

github.com/advisories/GHSA-v642-mh27-8j6m
github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1
github.com/mantisbt/mantisbt/security/advisories/GHSA-v642-mh27-8j6m
mantisbt.org/bugs/view.php?id=32981
nvd.nist.gov/vuln/detail/CVE-2023-44394

Detect and mitigate CVE-2023-44394 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →