NVD

Id
44409  
Name
CVE-2012-2692  
Description
MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.  
Reject
 
CVSS Version
2  
CVSS Score
3.6  
Severity
Low  
CVSS Base Score
3.6  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:N/AC:H/Au:S/C:N/I:P/A:P)  
Pub Date
2017-01-19  
Published
2012-06-16  
Modified Date
2013-08-26  
Seq
2012-2692  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
222828 44409 CVE-2012-2692 FEDORA-2012-18273  View
222829 44409 CVE-2012-2692 FEDORA-2012-18299  View
222830 44409 CVE-2012-2692 FEDORA-2012-18294  View
222831 44409 CVE-2012-2692 GLSA-201211-01  View
222832 44409 CVE-2012-2692 http://www.mantisbt.org/bugs/changelog_page.php?version_id=148  View
222833 44409 CVE-2012-2692 http://www.mantisbt.org/bugs/view.php?id=14016  View
222834 44409 CVE-2012-2692 [oss-security] 20120609 CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11  View
222835 44409 CVE-2012-2692 [oss-security] 20120611 Re: CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11  View
222836 44409 CVE-2012-2692 53921  View
222837 44409 CVE-2012-2692 https://github.com/mantisbt/mantisbt/commit/ceafe6f0c679411b81368052633a63dd3ca06d9c  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27075 JVNDB-2012-002782 MantisBT におけるアクセス制限を回避される脆弱性 MantisBT は、form_security_validation が OFF に設定されているとき、delete_attachments_threshold パーミッションを適切にチェックしないため、アクセス制限を回避され、任意の添付ファイルを削除される脆弱性が存在します。 CVE-2012-2692 55930 CVE-2012-2692 44409 3.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002782.html 2012-06-02 2012-06-20 View