CVE-2024-34080

Katalog CVE

CVSS 5.3 · Medium EPSS 0,70%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada mantisbt. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.

Rincian

Terbit di NVD

14 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q advisory vendor
• https://mantisbt.org/bugs/view.php?id=34434 issue tracking · patch · advisory vendor
• https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226 patch
• https://github.com/mantisbt/mantisbt/pull/2000 patch