CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote…

published June 29, 2012

CVSS
—
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02323 · 83.2th percentile
Published
2012-06-29T19:00Z
EPSS history
Timeline
  • 29 JUN 19:00Z
    The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote…
    cvelistv5