CVE-2008-4688

core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which…

published October 22, 2008

CVSS

—

EPSS

12%

Percentile

96.1

In the wild

Unconfirmed

What it is

core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.11709 · 96.1th percentile
Published: 2008-10-22T17:00Z

EPSS history

Timeline

22 OCT 17:00Z
core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which…
cvelistv5