Medium severity · published May 13, 2024
CVE-2024-34080
MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mantisbt · mantisbt
< 2.26.2 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34080
Patch
https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226
Patch
https://github.com/mantisbt/mantisbt/pull/2000
Vendor Advisory
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
Issue Tracking
https://mantisbt.org/bugs/view.php?id=34434
More from mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php