CVE-2002-1115 Missing authorization in n/a

Medium 5.0 Published 10 Sep 2002 Updated 8 Aug 2024

Remote attackers can view private bugs by manipulating the bug ID parameter in Mantis bug tracker pages.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2002-1115?

CVE-2002-1115 is a medium-severity missing authorization vulnerability in n/a, published on 10 Sep 2002. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_page.php, (2) bug_update_page.php, (3) view_bug_advanced_page.php, or (4) view_bug_page.php.

Which versions are affected by CVE-2002-1115?

It affects 1 product.

Products include Mantis Mantis.

How do I fix CVE-2002-1115?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2002-1115 being exploited?

There is no known exploitation of CVE-2002-1115 in the wild and no public exploit code.

Sources

Also known as GHSA-7m69-56cv-963j.