QwikSec

Security Database

CVE

CWE

Training

CVE-2012-2692

Published: Jun 17, 2012

Modified: Aug 6, 2024

PUBLISHED

Description

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

FEDORA-2012-18299

vendor-advisory

x_refsource_FEDORA

vdb-entry

x_refsource_BID

http://www.mantisbt.org/bugs/view.php?id=14016

x_refsource_CONFIRM

vendor-advisory

x_refsource_GENTOO

[oss-security] 20120611 Re: CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11

mailing-list

x_refsource_MLIST

http://www.mantisbt.org/bugs/changelog_page.php?version_id=148

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

FEDORA-2012-18294

vendor-advisory

x_refsource_FEDORA

[oss-security] 20120609 CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11

mailing-list

x_refsource_MLIST

FEDORA-2012-18273

vendor-advisory

x_refsource_FEDORA

https://github.com/mantisbt/mantisbt/commit/ceafe6f0c679411b81368052633a63dd3ca06d9c

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.