Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-34077

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-13 May, 2024 | 15:30
Updated At-02 Aug, 2024 | 02:42
Rejected At-
Credits

MantisBT user account takeover in the signup/reset password process

MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:13 May, 2024 | 15:30
Updated At:02 Aug, 2024 | 02:42
Rejected At:
▼CVE Numbering Authority (CNA)
MantisBT user account takeover in the signup/reset password process

MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).

Affected Products
Vendor
Mantis Bug Tracker (MantisBT)mantisbt
Product
mantisbt
Versions
Affected
  • < 2.26.2
Problem Types
TypeCWE IDDescription
CWECWE-305CWE-305: Authentication Bypass by Primary Weakness
CWECWE-620CWE-620: Unverified Password Change
Type: CWE
CWE ID: CWE-305
Description: CWE-305: Authentication Bypass by Primary Weakness
Type: CWE
CWE ID: CWE-620
Description: CWE-620: Unverified Password Change
Metrics
VersionBase scoreBase severityVector
3.17.3HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Version: 3.1
Base score: 7.3
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
x_refsource_CONFIRM
https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
x_refsource_MISC
https://mantisbt.org/bugs/view.php?id=34433
x_refsource_MISC
Hyperlink: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
Resource:
x_refsource_MISC
Hyperlink: https://mantisbt.org/bugs/view.php?id=34433
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Vendor
Mantis Bug Tracker (MantisBT)mantisbt
Product
mantisbt
CPEs
  • cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • -
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
x_refsource_CONFIRM
x_transferred
https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
x_refsource_MISC
x_transferred
https://mantisbt.org/bugs/view.php?id=34433
x_refsource_MISC
x_transferred
Hyperlink: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://mantisbt.org/bugs/view.php?id=34433
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:14 May, 2024 | 15:38
Updated At:16 Jan, 2025 | 16:40

MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.3HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary3.17.3HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Type: Secondary
Version: 3.1
Base score: 7.3
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Type: Primary
Version: 3.1
Base score: 7.3
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CPE Matches

Mantis Bug Tracker (MantisBT)
mantisbt
>>mantisbt>>Versions before 2.26.2(exclusive)
cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-305Secondarysecurity-advisories@github.com
CWE-620Secondarysecurity-advisories@github.com
NVD-CWE-OtherPrimarynvd@nist.gov
CWE ID: CWE-305
Type: Secondary
Source: security-advisories@github.com
CWE ID: CWE-620
Type: Secondary
Source: security-advisories@github.com
CWE ID: NVD-CWE-Other
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00security-advisories@github.com
Patch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqmsecurity-advisories@github.com
Exploit
Issue Tracking
Mitigation
Patch
Vendor Advisory
https://mantisbt.org/bugs/view.php?id=34433security-advisories@github.com
Exploit
Issue Tracking
Vendor Advisory
https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00af854a3a-2127-422b-91ae-364da2661108
Patch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqmaf854a3a-2127-422b-91ae-364da2661108
Exploit
Issue Tracking
Mitigation
Patch
Vendor Advisory
https://mantisbt.org/bugs/view.php?id=34433af854a3a-2127-422b-91ae-364da2661108
Exploit
Issue Tracking
Vendor Advisory
Hyperlink: https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
Source: security-advisories@github.com
Resource:
Exploit
Issue Tracking
Mitigation
Patch
Vendor Advisory
Hyperlink: https://mantisbt.org/bugs/view.php?id=34433
Source: security-advisories@github.com
Resource:
Exploit
Issue Tracking
Vendor Advisory
Hyperlink: https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Hyperlink: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Issue Tracking
Mitigation
Patch
Vendor Advisory
Hyperlink: https://mantisbt.org/bugs/view.php?id=34433
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Issue Tracking
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

2Records found

CVE-2020-14359
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.3||HIGH
EPSS-0.26% / 48.99%
||
7 Day CHG~0.00%
Published-23 Feb, 2021 | 12:42
Updated-04 Aug, 2024 | 12:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-louketo_proxykeycloak
CWE ID-CWE-305
Authentication Bypass by Primary Weakness
CVE-2024-6637
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-7.3||HIGH
EPSS-0.85% / 74.01%
||
7 Day CHG~0.00%
Published-20 Jul, 2024 | 07:37
Updated-11 Feb, 2025 | 15:43
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.

Action-Not Available
Vendor-WPWeb EliteYour Inspiration Solutions S.L.U. (YITH) (YITHEMES)
Product-woocommerce_social_loginWooCommerce - Social Loginyith_woocommerce_social_login
CWE ID-CWE-305
Authentication Bypass by Primary Weakness
Details not found