CVE-2024-34080

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34080", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-30T06:56:33.384Z", "datePublished": "2024-05-13T15:35:00.399Z", "dateUpdated": "2024-08-02T02:42:59.815Z"}, "containers": {"cna": {"title": "MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q"}, {"name": "https://github.com/mantisbt/mantisbt/pull/2000", "tags": ["x_refsource_MISC"], "url": "https://github.com/mantisbt/mantisbt/pull/2000"}, {"name": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226", "tags": ["x_refsource_MISC"], "url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226"}, {"name": "https://mantisbt.org/bugs/view.php?id=34434", "tags": ["x_refsource_MISC"], "url": "https://mantisbt.org/bugs/view.php?id=34434"}], "affected": [{"vendor": "mantisbt", "product": "mantisbt", "versions": [{"version": "< 2.26.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-13T15:35:00.399Z"}, "descriptions": [{"lang": "en", "value": "MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available."}], "source": {"advisory": "GHSA-99jc-wqmr-ff2q", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "mantisbt", "product": "mantisbt", "cpes": ["cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.26.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-13T18:31:57.581342Z", "id": "CVE-2024-34080", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T17:59:48.416Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.815Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q"}, {"name": "https://github.com/mantisbt/mantisbt/pull/2000", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mantisbt/mantisbt/pull/2000"}, {"name": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226"}, {"name": "https://mantisbt.org/bugs/view.php?id=34434", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://mantisbt.org/bugs/view.php?id=34434"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q", "name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/mantisbt/mantisbt/pull/2000", "name": "https://github.com/mantisbt/mantisbt/pull/2000", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226", "name": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://mantisbt.org/bugs/view.php?id=34434", "name": "https://mantisbt.org/bugs/view.php?id=34434", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.815Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34080", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-13T18:31:57.581342Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*"], "vendor": "mantisbt", "product": "mantisbt", "versions": [{"status": "affected", "version": "0", "lessThan": "2.26.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-13T18:31:13.074Z"}}], "cna": {"title": "MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor", "source": {"advisory": "GHSA-99jc-wqmr-ff2q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "mantisbt", "product": "mantisbt", "versions": [{"status": "affected", "version": "< 2.26.2"}]}], "references": [{"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q", "name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mantisbt/mantisbt/pull/2000", "name": "https://github.com/mantisbt/mantisbt/pull/2000", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226", "name": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226", "tags": ["x_refsource_MISC"]}, {"url": "https://mantisbt.org/bugs/view.php?id=34434", "name": "https://mantisbt.org/bugs/view.php?id=34434", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-13T15:35:00.399Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34080", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:42:59.815Z", "dateReserved": "2024-04-30T06:56:33.384Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-13T15:35:00.399Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "mantisbt", "vendor": "mantisbt", "versions": [{"status": "affected", "version": "< 2.26.2"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "mantisbt", "vendor": "mantisbt", "versions": [{"lessThan": "2.26.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*", "matchCriteriaId": "3EEBB443-A324-42A1-9D56-638BBE9702A4", "versionEndExcluding": "2.26.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available."}, {"lang": "es", "value": "MantisBT (Mantis Bug Tracker) es un rastreador de problemas de c\u00f3digo abierto. Si un problema hace referencia a una nota que pertenece a otro problema al que el usuario no tiene acceso, se crea un hiperv\u00ednculo. Al hacer clic en el enlace se produce un error de acceso denegado, como se esperaba, pero parte de la informaci\u00f3n permanece disponible a trav\u00e9s del enlace, la etiqueta del enlace y la informaci\u00f3n sobre herramientas. Esto puede dar como resultado la divulgaci\u00f3n de la existencia de la nota, el nombre del autor de la nota, la marca de tiempo de creaci\u00f3n de la nota y la identificaci\u00f3n del problema al que pertenece la nota. La versi\u00f3n 2.26.2 contiene un parche para el problema. No hay workarounds conocidos disponibles."}], "id": "CVE-2024-34080", "lastModified": "2026-06-17T07:32:51.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-34080", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-13T18:31:57.581342Z", "version": "2.0.3"}}]}, "published": "2024-05-14T15:38:29.703", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mantisbt/mantisbt/pull/2000"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://mantisbt.org/bugs/view.php?id=34434"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/mantisbt/mantisbt/pull/2000"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://mantisbt.org/bugs/view.php?id=34434"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}