CVE Request: Information disclosure in MantisBT

[Damien Regad <dregad () mantisbt org>]

Greetings,

Please assign a CVE ID for the following issue.


Description:

In MantisBT, the "Project Documentation" feature can be used to attach 
files to a project.

When this feature is enabled ($g_enable_project_documentation = ON) and 
the threshold to view these files is left to its default value 
($g_view_proj_doc_threshold = ANYBODY), any registered user in the 
system can download every such attachment, including those which are 
linked to private projects to which the user does not have access.

This can be achieved by calling the download script directly, and 
specifying the ID of the file to download, e.g.

http://example.com/mantis/file_download.php?file_id=123&type=doc


Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.2

Fixed in versions:
- 1.2.20 (not yet released)
- 1.3.0-rc1 (not yet released)

Patch:
See Github [1]

Credits:
The issue was discovered by Werner Karl and fixed by Damien Regad
(MantisBT Developer).

References:
Further details available in our issue tracker [2]


Best regards,
D. Regad
MantisBT Developer
http://www.mantisbt.org


[1] http://github.com/mantisbt/mantisbt/commit/f39cf525 (1.2.x)
    http://github.com/mantisbt/mantisbt/commit/a4be76d6 (1.3.x)
[2] https://mantisbt.org/bugs/view.php?id=19873