View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0037075 | mantisbt | api soap | public | 2026-04-18 17:25 | 2026-07-01 07:53 |
| Reporter | ninjasec | Assigned To | dregad | ||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 2.28.1 | ||||
| Target Version | 2.28.4 | Fixed in Version | 2.28.4 | ||
| Summary | 0037075: SOAP Issue Update Implicitly Reassigns Reporter To The Caller When reporter Is Omitted | ||||
| Description | mc_issue_update() defaults $t_reporter_id to the authenticated SOAP caller
As a result, a normal SOAP update that omits reporter ° EDIT dregad: the update is not silent, as the change is recorded in History. | ||||
| Steps To Reproduce |
| ||||
| Additional Information | Severity: Type: Affected code: Impact: | ||||
| Tags | No tags attached. | ||||
I confirm the reported behavior. however, the update is not silent, as the change is duly recorded in the issue's history so I would not qualify this as "hijacking the issue ownership". While it may be undesired and confusing to change the issue reporter when it's not specified in the payload, IMHO this is just a regular SOAP API bug, and not a security issue / vulnerability. I updated the steps to reproduce with proper, repeatable instructions. |
|
|
MantisBT: master-2.28 813c49a7 2026-05-31 20:35 Details Diff |
mc_issue_update() use current data as default Prevents unexpected changes when a field is not supplied in the payload (e.g. no 'reporter' results in Issue reporter being changed to the user performing the update). Fixes 0037075 |
Affected Issues 0037075 |
|
| mod - api/soap/mc_issue_api.php | Diff File | ||