CVE-2014-8988

MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and…

published November 24, 2014

CVSS
—
EPSS
2%
Percentile
80.1
In the wild
Unconfirmed
What it is

MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01951 · 80.1th percentile
Published
2014-11-24T15:00Z
EPSS history
Timeline
  • 24 NOV 15:00Z
    MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and…
    cvelistv5