MantisBT CVE-2020-25781: Unauthorized Access to Private Bug Note Attachments

Key Information Bug ID: 0027039 CVE ID: CVE-2020-25781 Summary: Access to private bug note attachments Description: Users can access public issues of a project, but do not have permission to access private bug notes of that project. However, they can download attachments of private bug notes via direct links. Priority: normal Severity: minor Reproducibility: always Status: closed Resolution: fixed Product Version: 2.23.0 Target Version: 2.24.3 Fixed Version: 2.24.3 Reporter: pljama Assigned To: dregad Submission Date: 2020-06-16 05:08 Last Update: 2020-09-25 14:53 Reproduction Steps 1. Create a user with project public access permissions and the ability to download public issue/bug note attachments. 2. Create a user with any project access permissions and the ability to create private bug notes with attachments. 3. attempts to download attachments of private bug notes created by via direct links. 4. can identify available files by replacing file IDs. Related Issues Related Issue 0026893: APIs expose private attachments to users who can access issues but not private notes. Related Issue 0009802: Support attachments associated with private notes. Duplicate Issue 0027262: Private files can be downloaded by attackers. Related Issue 0027299: Remove code duplication in file API. Related Issue 0026631: shows private files to users. Activity 2020-06-16: Vulnerability confirmed. 2020-09-19: CVE request submitted and assigned CVE-2020-25781. Patch submitted and fix discussion conducted. Related Code Changes Implemented checks for view/download capabilities at the bug note level. Prevented authorized users who can download attachments but cannot view private bug notes from accessing private note attachments via .

Goal Reached Thanks to every supporter — we hit 100%!

MantisBT CVE-2020-25781: Unauthorized Access to Private Bug Note Attachments