Listen to this Post
How the CVE Works:
This vulnerability exists in the `manage_config_columns_page.php` script. The “Copy From” functionality, intended for project managers to copy column configurations between projects, lacks proper access control checks. When a user with the MANAGER role in one project initiates a “Copy From” action and specifies the ID of a private project, the application does not verify if the user has any view or access permissions to that target private project. The script proceeds to read the column configuration data from the database for the specified private project ID and displays it in the user’s interface, effectively disclosing the private project’s column setup. The “Copy To” action correctly validates permissions, preventing data modification.
Platform: MantisBT
Version: < 2.27.2
Vulnerability: Info Disclosure
Severity: Moderate
date: 2025-11-03
Prediction: Patch 2025-11-10
What Undercode Say:
`curl -s “http://mantisbt-host/manage_config_columns_page.php?action=copy_from&project_id=1&from_project_id=2″`
` Attempts to copy config from project_id 2 (private) to project_id 1`
How Exploit:
- Attacker, a MANAGER in a valid project, accesses the column config page.
- Uses the “Copy From” feature, inputting the ID of a private project.
- The private project’s column configuration is retrieved and displayed.
Protection from this CVE:
Upgrade to MantisBT version 2.27.2 immediately. The patch adds an access level check to verify the user has VIEWER or higher rights on the source project before allowing its configuration to be copied.
Impact:
Unauthorized disclosure of a private project’s column configuration, potentially revealing internal workflow or data tracking structures.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
