Mantis 1.2.19 vulnerability

[plmaltais]

Hi,

I found a vulnerability in the current stable release of MantisBT (1.2.19). Using this vulnerability, an unauthenticated user can hijack another user account. Please provide an email address where I can send the vulnerability informations. I will release the technical details of the attack on my blog 90 days after this post.

Thank you,

Pier-Luc Maltais

[atrol]

Please follow the instructions at https://www.mantisbt.org/wiki/doku.php/ ... y_problems

[Rez]

Mr. Pier-Luc Maltais , Isn't it would be better if you share your vulnerability information here?
Thanks

[atrol]

Isn't it would be better if you share your vulnerability information here?

Why? Is there any advantage for MantisBT users?

[Rez]

Well, not sure, Just want to see the things

[atrol]

Just want to see the things

Also attackers.
Still no advantage for MantisBT users

[Rez]

[atrol]

Just want to see the things

You can now, https://www.mantisbt.org/bugs/view.php?id=19384