VIR Vulnerability Intelligence Relay

CVE-2012-2692

low
Published 2012-06-17 · Modified 2026-04-29
CVSS v3
—
CVSS v2
3.6
VIR risk
3.6

Description

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://github.com/mantisbt/mantisbt/commit/ceafe6f0c679411b81368052633a63dd3ca06d9c

Application impact
VendorProductVersionsFixed
mantisbtmantisbt{"endIncluding":"1.2.10"}
mantisbtmantisbt0.18.0
mantisbtmantisbt0.19.0
mantisbtmantisbt0.19.1
mantisbtmantisbt0.19.2
mantisbtmantisbt0.19.3
mantisbtmantisbt0.19.4
mantisbtmantisbt0.19.5
mantisbtmantisbt1.0.0
mantisbtmantisbt1.0.1
mantisbtmantisbt1.0.2
mantisbtmantisbt1.0.3
mantisbtmantisbt1.0.4
mantisbtmantisbt1.0.5
mantisbtmantisbt1.0.6
mantisbtmantisbt1.0.7
mantisbtmantisbt1.0.8
mantisbtmantisbt1.1.0
mantisbtmantisbt1.1.1
mantisbtmantisbt1.1.2
mantisbtmantisbt1.1.4
mantisbtmantisbt1.1.5
mantisbtmantisbt1.1.6
mantisbtmantisbt1.1.7
mantisbtmantisbt1.1.8
mantisbtmantisbt1.2.0
mantisbtmantisbt1.2.1
mantisbtmantisbt1.2.2
mantisbtmantisbt1.2.3
mantisbtmantisbt1.2.4
mantisbtmantisbt1.2.5
mantisbtmantisbt1.2.6
mantisbtmantisbt1.2.7
mantisbtmantisbt1.2.8
mantisbtmantisbt1.2.9

References

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.