CVE-2015-5059

The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php.
Configurations

Configuration 1 (hide)

cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-08-01 14:29

Updated : 2024-02-04 19:29


NVD link : CVE-2015-5059

Mitre link : CVE-2015-5059

CVE.ORG link : CVE-2015-5059


JSON object : View

Products Affected

mantisbt

  • mantisbt
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor