CVE-2025-62520

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-62520
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62520.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62520
Aliases
Published
2025-11-04T21:31:13.261Z
Modified
2025-12-05T10:21:21.127564Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MantisBT unauthorized disclosure of private project column configuration
Details

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manageconfigcolumns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62520.json",
    "cwe_ids": [
        "CWE-285"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mantisbt/mantisbt

Affected ranges

Type
GIT
Repo
https://github.com/mantisbt/mantisbt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a90611fb8939e72d2dab5e3a611127974a0e1929

Affected versions

release-1.*

release-1.2.0a1
release-1.2.0a2
release-1.2.0a3
release-1.2.0rc1
release-1.3.0
release-1.3.0-beta.1
release-1.3.0-beta.2
release-1.3.0-beta.3
release-1.3.0-rc.1
release-1.3.0-rc.2
release-1.3.1
release-1.3.2
release-1.3.3
release-1.3.4
release-1.3.5
release-1.3.6

release-2.*

release-2.0.0
release-2.0.0-beta.1
release-2.0.0-beta.2
release-2.0.0-beta.3
release-2.0.0-rc.1
release-2.0.0-rc.2
release-2.1.0
release-2.1.1
release-2.10.0
release-2.11.0
release-2.12.0
release-2.13.0
release-2.13.1
release-2.14.0
release-2.15.0
release-2.16.0
release-2.17.0
release-2.17.1
release-2.18.0
release-2.19.0
release-2.2.0
release-2.2.1
release-2.2.2
release-2.20.0
release-2.21.0
release-2.21.1
release-2.21.2
release-2.22.0
release-2.22.1
release-2.23.0
release-2.23.1
release-2.24.0
release-2.24.1
release-2.24.2
release-2.24.3
release-2.24.4
release-2.24.5
release-2.25.0
release-2.25.1
release-2.25.2
release-2.25.3
release-2.25.4
release-2.25.5
release-2.25.6
release-2.25.7
release-2.25.8
release-2.26.0
release-2.26.1
release-2.26.2
release-2.26.3
release-2.26.4
release-2.27.0
release-2.27.1
release-2.3.0
release-2.3.1
release-2.3.2
release-2.4.0
release-2.4.1
release-2.5.0
release-2.5.1
release-2.6.0
release-2.7.0
release-2.8.0
release-2.9.0