CVE-2024-34080 - CVE House

Back to Database

Status published Medium CVE-2024-34080

MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

5.3 CVSS

Vulnerability Description

MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34080

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from mantisbt

View All →

MantisBT unauthorized disclosure of private project column configuration

MantisBT: Authentication bypass for some passwords due to PHP type juggling

MantisBT: Authentication bypass for some passwords due to PHP type juggling

MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length

MantisBT vulnerable to information disclosure with user profiles

Affected Vendor

mantisbt

View all reports →

Affected Software

mantisbt

Vulnerable Versions:

< 2.26.2

Timeline

Official Publish: May 13th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel