GHSA-252r-f55f-ff34high8.8
MantisBT allows arbitrary password reset
Impact
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
mantisbt/mantisbt Packagist
| Affected range | Recorded fix |
|---|---|
| From 1.3.0-rc.2 before 1.3.10Ecosystem versions | 1.3.10 |
| From 2.0.0 before 2.2.4Ecosystem versions | 2.2.4 |
| From 2.3.0 before 2.3.1Ecosystem versions | 2.3.1 |
Version evidence: OSV · GHSA-252r-f55f-ff34
View original version evidence (1 explicit versions)
Original source description
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2017-7615
- Source reference github.com/mantisbt/mantisbt
- Source reference mantisbt.org/bugs/view.php
- Public exploit reference www.exploit-db.com/exploits/41890
- Security advisory hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
- Public exploit reference packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html
- Security advisory www.openwall.com/lists/oss-security/2017/04/16/2
- Source reference www.securityfocus.com/bid/97707