3.6

CVE-2012-2692

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mantisbt ≫ Mantisbt Version <= 1.2.10
Mantisbt ≫ Mantisbt Version 0.18.0
Mantisbt ≫ Mantisbt Version 0.19.0
Mantisbt ≫ Mantisbt Version 0.19.0 Update a1
Mantisbt ≫ Mantisbt Version 0.19.0 Update a2
Mantisbt ≫ Mantisbt Version 0.19.0 Update rc1
Mantisbt ≫ Mantisbt Version 0.19.1
Mantisbt ≫ Mantisbt Version 0.19.2
Mantisbt ≫ Mantisbt Version 0.19.3
Mantisbt ≫ Mantisbt Version 0.19.4
Mantisbt ≫ Mantisbt Version 0.19.5
Mantisbt ≫ Mantisbt Version 1.0.0
Mantisbt ≫ Mantisbt Version 1.0.0 Update a1
Mantisbt ≫ Mantisbt Version 1.0.0 Update a2
Mantisbt ≫ Mantisbt Version 1.0.0 Update a3
Mantisbt ≫ Mantisbt Version 1.0.0 Update rc1
Mantisbt ≫ Mantisbt Version 1.0.0 Update rc2
Mantisbt ≫ Mantisbt Version 1.0.0 Update rc3
Mantisbt ≫ Mantisbt Version 1.0.0 Update rc4
Mantisbt ≫ Mantisbt Version 1.0.0 Update rc5
Mantisbt ≫ Mantisbt Version 1.0.1
Mantisbt ≫ Mantisbt Version 1.0.2
Mantisbt ≫ Mantisbt Version 1.0.3
Mantisbt ≫ Mantisbt Version 1.0.4
Mantisbt ≫ Mantisbt Version 1.0.5
Mantisbt ≫ Mantisbt Version 1.0.6
Mantisbt ≫ Mantisbt Version 1.0.7
Mantisbt ≫ Mantisbt Version 1.0.8
Mantisbt ≫ Mantisbt Version 1.1.0
Mantisbt ≫ Mantisbt Version 1.1.1
Mantisbt ≫ Mantisbt Version 1.1.2
Mantisbt ≫ Mantisbt Version 1.1.4
Mantisbt ≫ Mantisbt Version 1.1.5
Mantisbt ≫ Mantisbt Version 1.1.6
Mantisbt ≫ Mantisbt Version 1.1.7
Mantisbt ≫ Mantisbt Version 1.1.8
Mantisbt ≫ Mantisbt Version 1.2.0
Mantisbt ≫ Mantisbt Version 1.2.0 Update alpha1
Mantisbt ≫ Mantisbt Version 1.2.0 Update alpha2
Mantisbt ≫ Mantisbt Version 1.2.1
Mantisbt ≫ Mantisbt Version 1.2.2
Mantisbt ≫ Mantisbt Version 1.2.3
Mantisbt ≫ Mantisbt Version 1.2.4
Mantisbt ≫ Mantisbt Version 1.2.5
Mantisbt ≫ Mantisbt Version 1.2.6
Mantisbt ≫ Mantisbt Version 1.2.7
Mantisbt ≫ Mantisbt Version 1.2.8
Mantisbt ≫ Mantisbt Version 1.2.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.46% 0.702
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.6 3.9 4.9
AV:N/AC:H/Au:S/C:N/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/51199
http://security.gentoo.org/glsa/glsa-201211-01.xml
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
http://www.mantisbt.org/bugs/changelog_page.php?version_id=148
http://www.openwall.com/lists/oss-security/2012/06/09/1
http://www.openwall.com/lists/oss-security/2012/06/11/6
http://www.mantisbt.org/bugs/view.php?id=14016
http://www.securityfocus.com/bid/53921
https://github.com/mantisbt/mantisbt/commit/ceafe6f0c679411b81368052633a63dd3ca06d9c
Patch