CVE-2012-1118

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not...

4.3 MediumFix available

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.

Exploit likelihood

3.03%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2012-1118
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-1118
Updated: 2026-11-02

EUVDEUVD-2012-1152 No score

Record: EUVD-2012-1152
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7p94-5vjx-c87f No score

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not...

Record: GHSA-7p94-5vjx-c87f
Updated: 2026-11-02

Affected products

mantisbt

Affected packages

Affected packages
Package	Affected	Fixed
`mantis` Debian:6.0	before 1.1.8+dfsg-10squeeze2, plus listed versions 1.1.8+dfsg-101.1.8+dfsg-10squeeze1	1.1.8+dfsg-10squeeze2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-1118 is a medium vulnerability (CVSS 4.3) in Mantisbt, published June 24, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.03%, the 87th percentile. Fixed in mantis 1.1.8+dfsg-10squeeze2.

References

Show 9 moreShow less