Skip to content

Commit 364cc94

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4v8w-gg5j-ph37 GHSA-r3jf-hm7q-qfw5
1 parent d3bd028 commit 364cc94

File tree

2 files changed

+139
-0
lines changed

2 files changed

+139
-0
lines changed

‎advisories/github-reviewed/2025/11/GHSA-4v8w-gg5j-ph37/GHSA-4v8w-gg5j-ph37.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v8w-gg5j-ph37",
4+
"modified": "2025-11-03T17:07:36Z",
5+
"published": "2025-11-03T17:07:36Z",
6+
"aliases": [
7+
"CVE-2025-47776"
8+
],
9+
"summary": "MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling",
10+
"details": "Due to an incorrect use of loose (`==`) instead of strict (`===`) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.\n\n[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication_api.php#L782\n\n### Impact\nOn MantisBT instances configured to use the *MD5* login method, user accounts having a password hash evaluating to zero (i.e. matching regex `^0+[Ee][0-9]+$`) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example `comito5` (0e579603064547166083907005281618). \n\nNo password bruteforcing for individual users is needed, thus $g_max_failed_login_count does not protect against the attack.\n\n### Patches\nFixed in 2.27.2.\n\n### Workarounds\nCheck the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL:\n```sql\nSELECT username, email FROM mantis_user_table WHERE password REGEXP '^0+[Ee][0-9]+$'\n```\n\n### Credits\nThanks to Harry Sintonen / Reversec for discovering and reporting the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "mantisbt/mantisbt"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.27.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4v8w-gg5j-ph37"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/mantisbt/mantisbt"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication_api.php#L782"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://mantisbt.org/bugs/view.php?id=35967"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-305",
63+
"CWE-697"
64+
],
65+
"severity": "HIGH",
66+
"github_reviewed": true,
67+
"github_reviewed_at": "2025-11-03T17:07:36Z",
68+
"nvd_published_at": null
69+
}
70+
}

‎advisories/github-reviewed/2025/11/GHSA-r3jf-hm7q-qfw5/GHSA-r3jf-hm7q-qfw5.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r3jf-hm7q-qfw5",
4+
"modified": "2025-11-03T17:07:39Z",
5+
"published": "2025-11-03T17:07:39Z",
6+
"aliases": [
7+
"CVE-2025-46556"
8+
],
9+
"summary": "MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length",
10+
"details": "A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:\n\n### Impact\n- The entire activity stream becomes unviewable (UI fails to render).\n- New notes cannot be displayed, effectively breaking all future collaboration on the issue.\n\n### Patches\nFixed in 2.27.2.\n\n### Workarounds\nNone\n\n### Credits\nThanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "mantisbt/mantisbt"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.27.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-r3jf-hm7q-qfw5"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/mantisbt/mantisbt/commit/e9119c68b4a0eaa0bbde3deb121e81f5f7157361"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/mantisbt/mantisbt"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-770"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-11-03T17:07:39Z",
67+
"nvd_published_at": null
68+
}
69+
}

0 commit comments

Comments
 (0)