CVE-2020-25781
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-25781
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25781.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-25781
- Published
- 2020-09-30T21:15:13Z
- Modified
- 2024-09-03T03:23:38.413081Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
- References
Affected packages
Git / github.com/mantisbt/mantisbt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mantisbt/mantisbt
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
release-1.*
release-1.2.0a1
release-1.2.0a2
release-1.2.0a3
release-1.2.0rc1
release-1.3.0
release-1.3.0-beta.1
release-1.3.0-beta.2
release-1.3.0-beta.3
release-1.3.0-rc.1
release-1.3.0-rc.2
release-1.3.1
release-1.3.2
release-1.3.3
release-1.3.4
release-1.3.5
release-1.3.6
release-2.*
release-2.0.0
release-2.0.0-beta.1
release-2.0.0-beta.2
release-2.0.0-beta.3
release-2.0.0-rc.1
release-2.0.0-rc.2
release-2.1.0
release-2.1.1
release-2.10.0
release-2.11.0
release-2.12.0
release-2.13.0
release-2.13.1
release-2.14.0
release-2.15.0
release-2.16.0
release-2.17.0
release-2.17.1
release-2.18.0
release-2.19.0
release-2.2.0
release-2.2.1
release-2.2.2
release-2.20.0
release-2.21.0
release-2.21.1
release-2.21.2
release-2.22.0
release-2.22.1
release-2.23.0
release-2.23.1
release-2.24.0
release-2.24.1
release-2.24.2
release-2.3.0
release-2.3.1
release-2.3.2
release-2.4.0
release-2.4.1
release-2.5.0
release-2.5.1
release-2.6.0
release-2.7.0
release-2.8.0
release-2.9.0