CVE-2012-1120

Published Jun 29, 2012 CVSS 2.0 · 3.6 Low EPSS 2.3% KEV · Not listed
Description
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2500-1 mantis security update
EUVD EUVD EUVD-2012-1154 The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 6:45 PM
Reserved
Feb 14, 2012, 12:00 AM
Status
Modified
Published
Jun 29, 2012, 7:55 PM
Modified
Jun 16, 2026, 11:39 PM