CVE-2024-23830

MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define `$g_path` as appropriate in `config_inc.php`.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744	Patch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528	Patch Vendor Advisory
https://mantisbt.org/bugs/view.php?id=19381	Exploit Vendor Advisory
https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744	Patch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528	Patch Vendor Advisory
https://mantisbt.org/bugs/view.php?id=19381	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-20 22:15

Updated : 2024-12-18 18:03

NVD link : CVE-2024-23830

Mitre link : CVE-2024-23830

CVE.ORG link : CVE-2024-23830

JSON object : View

Products Affected

mantisbt

mantisbt

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

NVD-CWE-noinfo

{"id": "CVE-2024-23830", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2024-02-20T22:15:08.460", "references": [{"url": "https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://mantisbt.org/bugs/view.php?id=19381", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://mantisbt.org/bugs/view.php?id=19381", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define `$g_path` as appropriate in `config_inc.php`."}, {"lang": "es", "value": "MantisBT es un rastreador de problemas de c\u00f3digo abierto. Antes de la versi\u00f3n 2.26.1, un atacante no autenticado que conoce la direcci\u00f3n de correo electr\u00f3nico y el nombre de usuario de un usuario puede secuestrar la cuenta del usuario envenenando el enlace en el mensaje de notificaci\u00f3n de restablecimiento de contrase\u00f1a. Hay un parche disponible en la versi\u00f3n 2.26.1. Como workaround, defina `$g_path` seg\u00fan corresponda en `config_inc.php`."}], "lastModified": "2024-12-18T18:03:25.023", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81B9361B-548F-4857-87ED-35D90583B988", "versionEndExcluding": "2.26.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}