Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2013-1811: MantisBT lets reporters reset any issue to New
CVE-2013-1811 · published 6 years ago
Summary
In MantisBT versions earlier than 1.2.13, users with the basic "Reporter" role can change the status of any ticket back to "New," which could reopen work that was thought to be finished. This may cause confusion and extra effort for your team. Update MantisBT to version 1.2.13 or later, or restrict who has Reporter rights, to prevent this.
What to do
- Update mantisbt mantisbt to version 1.2.13 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mantisbt | mantisbt |
< 1.2.13 cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* |
| debian | debian_linux |
6.0 7.0 cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
Original advisory text
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".
References
- http://www.debian.org/security/2015/dsa-3120 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/03/6 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/04/9 Mailing List Third Party Advisory
- https://mantisbt.org/bugs/view.php?id=15258 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2013-1811 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published7 Nov 2019
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2013-1811 · NVD
Track software like this
Free during beta