Re: CVE request: MantisBT before 1.2.13 "Change Status To" feature allows unauthorised workflow changes

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/01/2013 11:33 AM, Salvatore Bonaccorso wrote:
> Hi Kurt
>
> Noticed that the following CVE request did not got a CVE. Would it be
> possible to assign a CVE to this?
>
> On Sat, Jan 19, 2013 at 11:35:06AM +1100, David Hicks wrote:
> > Hello again list,
> >
> > Damien Regad (MantisBT developer) discovered and fixed[1] an access
> > control/permissions bug in MantisBT that exists in MantisBT version
> > 1.2.12 and prior.
> >
> > A MantisBT user with "Reporter" permissions (enabling them to
> > report/create new issues) can modify the workflow status of any issue to
> > "New" even if they do not have the necessary permission to make this
> > change.
> >
> > Details of the bug, including steps to reproduce and patches are
> > available at [1].
> >
> > References:
> > [1] http://www.mantisbt.org/bugs/view.php?id=15258
> >
> > As per previous e-mails to this list within the past 24 hours, MantisBT
> > 1.2.13 is expected to be released early next week.
> >
> > Can a CVE ID please be assigned to this issue?

Please use CVE-2013-1811 for this issue.

regarding the past email ctrl-c, ctrl-v, same thing right?

> > With thanks,
> > David Hicks
> > MantisBT Developer
> > #mantisbt irc.freenode.net
> > http://www.mantisbt.org/bugs/
>
> Regards,
> Salvatore


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRMsbsAAoJEBYNRVNeJnmTJywP/iekMslqs479EEQAXadz7AVT
wUxFBMZyalKBUTBQBfBh484ImReFR5zPnnJwOzgf8zn5U/CZLDF49kOCGvYvxlXM
Gd1Z3s+xtc54zhJOhrEpLKn3jYbSVNx1/Xi9SY2DNsgE9356MopuZFYZMqh3aIpH
F2F6Z7a1LGuLbH3s1FRpWsGvJLtD7H4Y+ORmNpQyxOMy+Y4IsvyKeP/SXXAnX3Mu
FMBnip1brK9uw8crHiZCJuSsGHCmvQZ6om/YGNFvjDJb8Z8MvQMX6uyIPZS3BgQT
tc4dqI8YPrmDBjAVKii44av2YPuA++LdwKp0+sgI2A9+ctMtI3zGgbiDPRBglpC8
QYrZrqK3vfPbl4BQH8iHzwUqz1bSD8LsluE+5GQKDvhXEeN3ruFWHwGmOUdv2wdI
ZqUScEJE4ZWBLlsReaZzNvVVNdJh1dwhdEuBMFt+Z0rFRgF6CKH4KdjlI/L2XOQT
FIsib+BlNuuHPvfTBLs0WlzYIjjt/vFMRKQj2OxFl+8YzIQTfvm/gwTtObaBU9Hq
Tkx43du+fPcE6zyCoNHc8D89hHQ3YNJM2Vnmpr2EEuh4bXb+ihGocdn/+ScLNNPf
7e2iavcD1Uq0EaL1ODW3cSaX0RjAilB2/7hx83unlNp1DQvt0RlAGheDG+V5JIOr
p5Fq3w8XmTsO0tVkfH6t
=fGdi
-----END PGP SIGNATURE-----