CVE-2024-45792

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
mantisbt	mantisbt	< 2.26.4

References

https://github.com/mantisbt/mantisbt/commit/ef0f820284032350cc20a39ff9cb2010d5463b41Patch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7rPatch, Vendor Advisory
https://mantisbt.org/bugs/view.php?id=34640Issue Tracking

Timeline

Published: Sep 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-457934.8Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are CVE-2024-457948.8devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) cou CVE-2024-457957.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7 CVE-2024-457965.3Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7 CVE-2024-457977.5LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HT CVE-2024-457989.9arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI CVE-2024-457996.1FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and CVE-2024-45805.4The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C CVE-2024-458005.0Snappymail is an open source web-based email client. SnappyMail uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research CVE-2024-458016.1DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using CVE-2024-458027.5Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resou CVE-2024-458036.1Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting (