Medium severity · published Sep 30, 2020
CVE-2020-25781
An issue was discovered in file_download.php in MantisBT before 2.24.3
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mantisbt · Mantisbt
before 2.24.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25781
Patch
http://github.com/mantisbt/mantisbt/commit/5595c90f11c48164331a20bb9c66098980516e93
Patch
http://github.com/mantisbt/mantisbt/commit/9de20c09e5a557e57159a61657ce62f1a4f578fe
Exploit
https://mantisbt.org/bugs/view.php?id=27039
More from Mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php