Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
MantisBT 信息泄露漏洞
Vulnerability Description
MantisBT是MantisBT团队的一套基于Web的开源缺陷跟踪系统。该系统以Web操作的形式提供项目管理及缺陷跟踪服务。 MantisBT 1.2.19及之前的版本中的Project Documentation功能存在安全漏洞。远程攻击者可通过向file_download.php发送带有文件id编号的‘file_id’参数利用该漏洞下载链接到任意私人项目的附件。
CVSS Information
N/A
Vulnerability Type
N/A