Description
core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.
References
- 32243 third-party-advisory
- http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384
- 31868 vdb-entry
- 32975 third-party-advisory
- GLSA-200812-07 vendor-advisory
- http://www.mantisbt.org/bugs/changelog_page.php
- [oss-security] 20081020 Re: CVE request: mantisbt < 1.1.4: RCE mailing-list
- http://www.mantisbt.org/bugs/view.php?id=9321