CVE-2025-62520

Katalog CVE

CVSS 4.3 · Medium EPSS 0,26%

Kerentanan Improper Authorization pada mantisbt. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.

Rincian

Terbit di NVD

4 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-g582-8vwr-68h2 advisory vendor
• https://mantisbt.org/bugs/view.php?id=36502 exploit · issue tracking · advisory vendor
• https://github.com/mantisbt/mantisbt/commit/4fe94f45fa2baea2aeb4b65781d2009e7b4a0bf3 patch