Dependency Graph
View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0037075 | mantisbt | api soap | public | 2026-04-18 17:25 | 2026-05-31 20:10 |
| Reporter | ninjasec | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | confirmed | Resolution | open | ||
| Product Version | 2.28.1 | ||||
| Target Version | 2.28.4 | ||||
| Summary | 0037075: SOAP Issue Update Implicitly Reassigns Reporter To The Caller When reporter Is Omitted | ||||
| Description | mc_issue_update() defaults $t_reporter_id to the authenticated SOAP caller
As a result, a normal SOAP update that omits reporter silently rewrites the | ||||
| Steps To Reproduce |
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope" xmlns:mc="http://futureware.biz"
mysql> SELECT id, reporter_id, summary FROM mantis_bug_table WHERE id=42897; | ||||
| Additional Information | Severity: Type: Affected code: Impact: | ||||
| Tags | No tags attached. | ||||
I confirm the reported behavior. however, the update is not silent, as the change is duly recorded in the issue's history so I would not qualify this as "hijacking the issue ownership". While it may be undesired and confusing to change the issue reporter when it's not specified in the payload, IMHO this is just a regular SOAP API bug, and not a security issue / vulnerability. I updated the steps to reproduce with proper, repeatable instructions. |
|
related to
child of
duplicate of