Skip to main content

Insecure Storage of Sensitive Information

CVE-2020-29603

Medium
4/10

Summary

In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.

  • LOW
  • NETWORK
  • SINGLE
  • NONE
  • PARTIAL
  • NONE

CWE-922 - Insecure Storage of Sensitive Information

The software stores sensitive information without properly limiting read or write access by unauthorized actors.

References

Advisory Timeline

  • Published