CVE-2020-29603 : Security Advisory and Response

In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.

Understanding CVE-2020-29603

This CVE involves a vulnerability in MantisBT that allows unauthorized users to access Private Projects' names.

What is CVE-2020-29603?

The vulnerability in MantisBT before version 2.24.4 enables unprivileged logged-in users to obtain Private Projects' names through the project_id parameter.

The Impact of CVE-2020-29603

Unauthorized users can access sensitive information about Private Projects, potentially leading to data breaches or unauthorized project access.

Technical Details of CVE-2020-29603

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability allows unprivileged users to retrieve Private Projects' names without proper access.

Affected Systems and Versions

Product: MantisBT
Versions affected: Before 2.24.4

Exploitation Mechanism

Unauthorized users exploit the manage_proj_edit_page.php project_id parameter to retrieve Private Projects' names.

Mitigation and Prevention

Protecting systems from CVE-2020-29603 is crucial to prevent unauthorized access and data breaches.

Immediate Steps to Take

Upgrade MantisBT to version 2.24.4 or newer to mitigate the vulnerability.
Restrict access to sensitive project information to authorized users only.

Long-Term Security Practices

Regularly review and update access control policies within MantisBT.
Conduct security training for users to raise awareness about data protection.

Patching and Updates

Stay informed about security updates for MantisBT and promptly apply patches to address vulnerabilities.