CVE-2018-9839
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-9839
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-9839.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2018-9839
- Published
- 2019-06-06T19:29:00Z
- Modified
- 2025-07-01T06:30:43.909312Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bugreportpage.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).
- References
Affected packages
Git / github.com/mantisbt/mantisbt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mantisbt/mantisbt
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
release-1.*
release-1.2.0a1
release-1.2.0a2
release-1.2.0a3
release-1.2.0rc1
release-1.3.0
release-1.3.0-beta.1
release-1.3.0-beta.2
release-1.3.0-beta.3
release-1.3.0-rc.1
release-1.3.0-rc.2
release-1.3.1
release-1.3.2
release-1.3.3
release-1.3.4
release-1.3.5
release-1.3.6
release-2.*
release-2.0.0
release-2.0.0-beta.1
release-2.0.0-beta.2
release-2.0.0-beta.3
release-2.0.0-rc.1
release-2.0.0-rc.2
release-2.1.0
release-2.1.1
release-2.10.0
release-2.11.0
release-2.12.0
release-2.13.0
release-2.13.1
release-2.2.0
release-2.2.1
release-2.2.2
release-2.3.0
release-2.3.1
release-2.3.2
release-2.4.0
release-2.4.1
release-2.5.0
release-2.5.1
release-2.6.0
release-2.7.0
release-2.8.0
release-2.9.0