CVE-2012-1122

bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report…

published June 29, 2012

CVSS
—
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02425 · 84.0th percentile
Published
2012-06-29T19:00Z
EPSS history
Timeline
  • 29 JUN 19:00Z
    bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report…
    cvelistv5