VULNERABILITY INTELLIGENCE
CVE-2020-25781
CVSS score4.3 MEDIUM
EPSS probability0.94%
CISA KEVNot currently listed
Published2020-09-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
Weakness classification
- nvd@nist.gov: CWE-862
Primary references
- cve@mitre.org — Patch, Third Party Advisory
- cve@mitre.org — Patch, Third Party Advisory
- cve@mitre.org — Exploit, Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Vendor Advisory