CVE-2024-34080 json
MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
published 2024-05-13 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1549 , GHSA-99jc-wqmr-ff2q
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.
Patch / fix
- packagist mantisbt/mantisbt 2.26.2
- mantisbt mantisbt 2.26.2
- github.com/mantisbt/mantisbt@0a50562 commit
- github.com/mantisbt/mantisbt#2000 pull request
- mantisbt.org/bugs/view.php?id=34434 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mantisbt/mantisbt | <2.26.2 |
2.26.2 |
Affected products
- mantisbt mantisbt
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/mantisbt/mantisbt/pull/2000
web, patch
-
github.com
/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226
web, patch
-
mantisbt.org
/bugs/view.php?id=34434
web, issue-tracking, patch, vendor-advisory
-
github.com
/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-34080
advisory
-
github.com
/mantisbt/mantisbt
package
Sources
- CVE List CVE-2024-34080
- GitHub Advisory GHSA-99jc-wqmr-ff2q
- NVD CVE-2024-34080
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.