CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 3.6
CWE Name:  Permissions Privileges and Access Controls
Summary: the soap api in mantisbt before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write soap api privileges to delete arbitrary bug reports and bug notes.
Access Authentication: SINGLE
Access Complexity: HIGH
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/PARTIAL
Published Date: 2012-06-29
Last Modified Date: 2013-08-27