GHSA-v642-mh27-8j6mMediumCVSS 4.3

MantisBT may disclose project names to unauthorized users

Published
October 17, 2023
Last Modified
August 11, 2025

🔗 CVE IDs covered (1)

CVE-2023-44394 →

📋 Description

Impact

Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs.

Patches

The vulnerability has been fixed in MantisBT version 2.25.8 (https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1).

Workarounds

Disable wiki integration ( $g_wiki_enable = OFF;)

References

  • https://mantisbt.org/bugs/view.php?id=32981

🎯 Affected products1

  • composer/mantisbt/mantisbt:<= 2.25.7

🔗 References (5)