CVE-2017-7615: MantisBT Arbitrary Password Reset Vulnerability
Summary
CVE-2017-7615: MantisBT allows arbitrary password reset. Affects mantisbt/mantisbt across 3 version ranges.
>= 1.3.0-rc.2, < 1.3.10
>= 2.0.0, < 2.2.4
>= 2.3.0, < 2.3.1
Fixed in 1.3.10, 2.2.4 or 2.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps software development teams manage and track issues effectively. It provides features such as issue tracking, project management, and reporting tools. However, certain versions of MantisBT are vulnerable to an arbitrary password reset, allowing unauthorized users to gain access to accounts without proper authentication.
Vulnerability Detail
The vulnerability arises from the ability to reset passwords without proper verification. Specifically, MantisBT versions up to 2.3.0 allow an attacker to exploit an empty 'confirm_hash' value in the 'verify.php' script. This flaw can lead to unauthorized access to user accounts, including administrative accounts, posing significant security risks to the integrity of the application and its data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.3.0-rc.2, < 1.3.101.3.10composer require mantisbt/mantisbt:1.3.10 -
>= 2.0.0, < 2.2.42.2.4composer require mantisbt/mantisbt:2.2.4 -
>= 2.3.0, < 2.3.12.3.1composer require mantisbt/mantisbt:2.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the password reset functionality until the application is updated. This can be done by modifying the configuration settings in MantisBT to restrict access to the password reset feature.
Conclusion
The CVE-2017-7615 vulnerability in MantisBT poses significant risks due to its potential for unauthorized access. It is crucial for users to update to the latest patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
CVE-2017-7615 is a vulnerability in MantisBT that allows arbitrary password resets and unauthorized access to accounts.
MantisBT versions up to 2.3.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If immediate updates are not possible, consider disabling the password reset feature as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
