CVE-2018-9839: Improper Input Validation (CWE-20)
value: An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2019-06-06T19:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: bug_report.php, bug_report_page.php
Commit date: 2018-04-25 18:38:57 +0200
Commit message: Prevent cloning private issues by unauthorized users

Using a crafted request on bug_report_page.php (modifying the 'm_id'
parameter), any user with REPORTER access or above is able to view any
private issue's details (summary, description, steps to reproduce,
additional information) when cloning. By checking the 'Copy issue notes'
and 'Copy attachments' checkboxes and completing the clone operation,
this data also becomes public (except private notes).

Credits to Mustafa Hasan (strukt) strukt93@gmail.com for the finding.

@atrol noted that the same vulnerability also existed in bug_report.php,
although in this case the information disclosure is limited to notes and
attachments (issue data itself does not become accessible).

Added an access level check, so that the operation now fails with an
Access Denied error in both cases.

Fixes #24221, CVE-2018-9839
Prevent cloning private issues by unauthorized users

Using a crafted request on bug_report_page.php (modifying the 'm_id'
parameter), any user with REPORTER access or above is able to view any
private issue's details (summary, description, steps to reproduce,
additional information) when cloning. By checking the 'Copy issue notes'
and 'Copy attachments' checkboxes and completing the clone operation,
this data also becomes public (except private notes).

Added an access level check, so that the operation now fails with an
Access Denied error.

Credits to Mustafa Hasan (strukt) strukt93@gmail.com for the finding.

Fixes #24221

Diff: diff --git a/bug_report.php b/bug_report.php
index 576ea2dc86..362f163409 100644
--- a/bug_report.php
+++ b/bug_report.php
@@ -67,10 +67,14 @@ $t_clone_info = array(
 	'copy_files' => $f_copy_attachments_from_parent
 );
 
 if( $f_master_bug_id > 0 ) {
 	bug_ensure_exists( $f_master_bug_id );
+
+	# User can view the master bug
+	access_ensure_bug_level( config_get( 'view_bug_threshold' ), $f_master_bug_id );
+
 	if( bug_is_readonly( $f_master_bug_id ) ) {
 		error_parameters( $f_master_bug_id );
 		trigger_error( ERROR_BUG_READ_ONLY_ACTION_DENIED, ERROR );
 	}
 	$t_master_bug = bug_get( $f_master_bug_id, true );
diff --git a/bug_report_page.php b/bug_report_page.php
index dd37a2763d..c4c5eb7202 100644
--- a/bug_report_page.php
+++ b/bug_report_page.php
@@ -87,10 +87,13 @@ if( $f_master_bug_id > 0 ) {
 	if( bug_is_readonly( $f_master_bug_id ) ) {
 		error_parameters( $f_master_bug_id );
 		trigger_error( ERROR_BUG_READ_ONLY_ACTION_DENIED, ERROR );
 	}
 
+	# User can view the master bug
+	access_ensure_bug_level( config_get( 'view_bug_threshold' ), $f_master_bug_id );
+
 	$t_bug = bug_get( $f_master_bug_id, true );
 
 	#@@@ (thraxisp) Note that the master bug is cloned into the same project as the master, independent of
 	#       what the current project is set to.
 	if( $t_bug->project_id != helper_get_current_project() ) {

Fixed code: 
	# User can view the master bug
	access_ensure_bug_level( config_get( 'view_bug_threshold' ), $f_master_bug_id );

	# User can view the master bug
	access_ensure_bug_level( config_get( 'view_bug_threshold' ), $f_master_bug_id );