GHSA-252r-f55f-ff34 CVE-2017-7615
MantisBT allows arbitrary password reset
- Severity
- 8.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 91.20%
- Chance of exploitation in the next 30 days. Higher than 99.81% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
- Fix
1.3.10- Upgrade mantisbt/mantisbt to this version or later
Description
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| mantisbt/mantisbt | >= 1.3.0-rc.2, < 1.3.10 |
1.3.10 |
| mantisbt/mantisbt | >= 2.0.0, < 2.2.4 |
2.2.4 |
| mantisbt/mantisbt | >= 2.3.0, < 2.3.1 |
2.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mantisbt/mantisbt Packagist → 1.3.10
- composer
composer require mantisbt/mantisbt:^1.3.10
Severity breakdown
CVSS 3.0 8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
How to prevent it
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
- Architecture and Design: Assign a new temporary password rather than revealing the original password.
References
Advisories
Packages
Other links
- mantisbt.org/bugs/view.php
- exploit-db.com/exploits/41890
- hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
- packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html
- openwall.com/lists/oss-security/2017/04/16/2
- securityfocus.com/bid/97707
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-h2wf-967x-gxvw MantisBT: Stored XSS in print_all_bug_page_word.php | High | Also affects mantisbt/mantisbt |
| GHSA-4vpf-w7qv-5h3q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs | Medium | Also affects mantisbt/mantisbt |
| GHSA-3v2j-6fw9-f57c MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters | Medium | Also affects mantisbt/mantisbt |
| GHSA-vcrw-4xvv-jh49 MantisBT: Reflected XSS in admin/install.php via unescaped printf | Critical | Also affects mantisbt/mantisbt |
| GHSA-77x8-3v3h-hrhv MantisBT: Reflected XSS in admin/install.php | Critical | Also affects mantisbt/mantisbt |
| GHSA-m7ph-9558-mrx3 MantisBT: REST API unauthorized Issue status change | Medium | Also affects mantisbt/mantisbt |
| GHSA-v84x-qvhg-f36r MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php | High | Also affects mantisbt/mantisbt |
| GHSA-c2xg-qjqw-2v98 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator | Critical | Also affects mantisbt/mantisbt |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor