CVE-2012-2692

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote…

published June 17, 2012

CVSS
—
EPSS
1%
Percentile
73.3
In the wild
Unconfirmed
What it is

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01464 · 73.3th percentile
Published
2012-06-17T01:00Z
EPSS history
Timeline
  • 17 JUN 01:00Z
    MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote…
    cvelistv5