CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 3.6
CWE Name:  Permissions Privileges and Access Controls
Summary: mantisbt before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to off, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
Access Authentication: SINGLE
Access Complexity: HIGH
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/PARTIAL
Published Date: 2012-06-17
Last Modified Date: 2013-08-27