CVE-2020-25781

An issue was discovered in file_download.php in MantisBT before 2.24.3

published September 30, 2020

CVSS
—
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00938 · 60.5th percentile
Published
2020-09-30T20:31Z
EPSS history
Timeline
  • 30 SEP 20:31Z
    An issue was discovered in file_download.php in MantisBT before 2.24.3
    cvelistv5