MantisBT: master b2da7352

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master 2020-12-06 13:43 master 9322c8c9
Affected Issues  0027357: Attacker can leak private information via different functionality
 0027728: CVE-2020-29604: Full disclosure of private issue contents, including bugnotes and attachments
Changeset

Prevent full private issue disclosure

Missing access check in bug_actiongroup.php allows an attacker with
rights to create new issues to use the COPY group action to create a
clone of any private issue (including all bugnotes and attachments),
thus gaining full access to potentially confidential information.

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for reporting the issue.

Fixes 0027728, 0027357, CVE-2020-29604
mod - bug_actiongroup.php Diff File