CVE-2020-25781

Katalog CVE

CVSS 4.3 · Medium EPSS 0,94%

Kerentanan Missing Authorization pada mantisbt. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.

Rincian

Terbit di NVD

30 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,94% peluang dieksploitasi; lebih tinggi dari 59,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mantisbt.org/bugs/view.php?id=27039 exploit · patch · advisory vendor
• http://github.com/mantisbt/mantisbt/commit/5595c90f11c48164331a20bb9c66098980516e93 patch · advisory pihak ketiga
• http://github.com/mantisbt/mantisbt/commit/9de20c09e5a557e57159a61657ce62f1a4f578fe patch · advisory pihak ketiga