MantisBT: master 12a9dcbb

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master 2020-12-06 13:08 master cff10f26
Affected Issues  0027357: Attacker can leak private information via different functionality
 0027727: CVE-2020-29605: Disclosure of private issue summary
Changeset

Prevent disclosure of private issue summary

Insufficient access level checks allowed an attacker to display private
issues' summary via Group Actions (bug_actiongroup_page.php).

Going through the provided list of issue IDs (bug_arr[]) and removing
any issues the user does not have access to, fixes the vulnerability.

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for reporting the issue.

Fixes 0027727, 0027357, CVE-2020-29605
mod - bug_actiongroup_page.php Diff File