Vulnerabilities > CVE-2020-29603 - Insecure Storage of Sensitive Information vulnerability in Mantisbt

CVSS 4.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

mantisbt

CWE-922

NVD

Published: 2021-01-29

Updated: 2021-01-30

Summary

In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.

Vulnerable Configurations

Part	Description	Count
Application	Mantisbt Mantisbt Mantisbt 0.18.0 Mantisbt Mantisbt 0.19.0 Mantisbt Mantisbt 0.19.1 Mantisbt Mantisbt 0.19.2 Mantisbt Mantisbt 0.19.3 Mantisbt Mantisbt 0.19.4 Mantisbt Mantisbt 0.19.5 Mantisbt Mantisbt 1.0.0 Mantisbt Mantisbt 1.0.1 Mantisbt Mantisbt 1.0.2 Mantisbt Mantisbt 1.0.3 Mantisbt Mantisbt 1.0.4 Mantisbt Mantisbt 1.0.5 Mantisbt Mantisbt 1.0.6 Mantisbt Mantisbt 1.0.7 Mantisbt Mantisbt 1.0.8 Mantisbt Mantisbt 1.0.9 Mantisbt Mantisbt 1.1.0 Mantisbt Mantisbt 1.1.1 Mantisbt Mantisbt 1.1.2 Mantisbt Mantisbt 1.1.3 Mantisbt Mantisbt 1.1.4 Mantisbt Mantisbt 1.1.5 Mantisbt Mantisbt 1.1.6 Mantisbt Mantisbt 1.1.7 Mantisbt Mantisbt 1.1.8 Mantisbt Mantisbt 1.1.9 Mantisbt Mantisbt 1.2.0 Mantisbt Mantisbt 1.2.1 Mantisbt Mantisbt 1.2.2 Mantisbt Mantisbt 1.2.3 Mantisbt Mantisbt 1.2.4 Mantisbt Mantisbt 1.2.5 Mantisbt Mantisbt 1.2.6 Mantisbt Mantisbt 1.2.7 Mantisbt Mantisbt 1.2.8 Mantisbt Mantisbt 1.2.9 Mantisbt Mantisbt 1.2.10 Mantisbt Mantisbt 1.2.11 Mantisbt Mantisbt 1.2.12 Mantisbt Mantisbt 1.2.13 Mantisbt Mantisbt 1.2.14 Mantisbt Mantisbt 1.2.15 Mantisbt Mantisbt 1.2.16 Mantisbt Mantisbt 1.2.18 Mantisbt Mantisbt 1.2.19 Mantisbt Mantisbt 1.2.20 Mantisbt Mantisbt 1.3.0 Mantisbt Mantisbt 1.3.1 Mantisbt Mantisbt 1.3.2 Mantisbt Mantisbt 1.3.3 Mantisbt Mantisbt 1.3.4 Mantisbt Mantisbt 1.3.5 Mantisbt Mantisbt 1.3.6 Mantisbt Mantisbt 1.3.7 Mantisbt Mantisbt 1.3.8 Mantisbt Mantisbt 1.3.9 Mantisbt Mantisbt 1.3.10 Mantisbt Mantisbt 1.3.11 Mantisbt Mantisbt 1.3.12 Mantisbt Mantisbt 1.3.13 Mantisbt Mantisbt 1.3.14 Mantisbt Mantisbt 1.3.15 Mantisbt Mantisbt 1.3.16 Mantisbt Mantisbt 1.3.17 Mantisbt Mantisbt 1.3.18 Mantisbt Mantisbt 1.3.19 Mantisbt Mantisbt 1.3.20 Mantisbt Mantisbt 2.0.0 Mantisbt Mantisbt 2.0.1 Mantisbt Mantisbt 2.1.0 Mantisbt Mantisbt 2.1.1 Mantisbt Mantisbt 2.1.2 Mantisbt Mantisbt 2.1.3 Mantisbt Mantisbt 2.2.0 Mantisbt Mantisbt 2.2.1 Mantisbt Mantisbt 2.2.2 Mantisbt Mantisbt 2.2.3 Mantisbt Mantisbt 2.2.4 Mantisbt Mantisbt 2.3.0 Mantisbt Mantisbt 2.3.1 Mantisbt Mantisbt 2.3.2 Mantisbt Mantisbt 2.3.3 Mantisbt Mantisbt 2.4.0 Mantisbt Mantisbt 2.4.1 Mantisbt Mantisbt 2.4.2 Mantisbt Mantisbt 2.5.0 Mantisbt Mantisbt 2.5.1 Mantisbt Mantisbt 2.5.2 Mantisbt Mantisbt 2.6.0 Mantisbt Mantisbt 2.7.0 Mantisbt Mantisbt 2.7.1 Mantisbt Mantisbt 2.8.0 Mantisbt Mantisbt 2.8.1 Mantisbt Mantisbt 2.9.0 Mantisbt Mantisbt 2.9.1 Mantisbt Mantisbt 2.10.0 Mantisbt Mantisbt 2.10.1 Mantisbt Mantisbt 2.11.0 Mantisbt Mantisbt 2.11.1 Mantisbt Mantisbt 2.12.0 Mantisbt Mantisbt 2.12.1 Mantisbt Mantisbt 2.12.2 Mantisbt Mantisbt 2.13.0 Mantisbt Mantisbt 2.13.1 Mantisbt Mantisbt 2.13.2 Mantisbt Mantisbt 2.14.0 Mantisbt Mantisbt 2.15.0 Mantisbt Mantisbt 2.15.1 Mantisbt Mantisbt 2.16.0 Mantisbt Mantisbt 2.16.1 Mantisbt Mantisbt 2.17.0 Mantisbt Mantisbt 2.17.1 Mantisbt Mantisbt 2.17.2 Mantisbt Mantisbt 2.18.0 Mantisbt Mantisbt 2.18.1 Mantisbt Mantisbt 2.19.0 Mantisbt Mantisbt 2.19.1 Mantisbt Mantisbt 2.20.0 Mantisbt Mantisbt 2.20.1 Mantisbt Mantisbt 2.21.0 Mantisbt Mantisbt 2.21.1 Mantisbt Mantisbt 2.21.2 Mantisbt Mantisbt 2.21.3 Mantisbt Mantisbt 2.22.0 Mantisbt Mantisbt 2.22.1 Mantisbt Mantisbt 2.22.2 Mantisbt Mantisbt 2.23.0 Mantisbt Mantisbt 2.23.1 Mantisbt Mantisbt 2.24.0 Mantisbt Mantisbt 2.24.1 Mantisbt Mantisbt 2.24.2 Mantisbt Mantisbt 2.24.3	170
OS	Microsoft Microsoft Windows -	1

Common Weakness Enumeration (CWE)

CWE-922 - Insecure Storage of Sensitive Information

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References