CVE-2012-1121 (published 2012-06-29T19:55Z)

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:N/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: Damien Regad
author_date: 2012-01-02 01:14:31+01:00
msg: User must have global access to update global categories

The user's global access level must be >= $g_manage_site_threshold to
be allowed to add, edit or delete global categories.

Prior to this, once a user had been defined as Manager on at least one
project, they could freely update global categories.

Also prevents such updates through URL manipulation.

Fixes #13561
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: manage_proj_cat_delete.php
change_type: ModificationType.MODIFY
diff: @@ -60,12 +60,12 @@ auth_reauthenticate();
 $f_category_id = gpc_get_int( 'id' );
 $f_project_id = gpc_get_int( 'project_id' );
 
-access_ensure_project_level( config_get( 'manage_project_threshold' ), $f_project_id );
-
 $t_row = category_get_row( $f_category_id );
 $t_name = category_full_name( $f_category_id );
 $t_project_id = $t_row['project_id'];
 
+access_ensure_project_level( config_get( 'manage_project_threshold' ), $t_project_id );
+
 # Get a bug count
 $t_bug_table = db_get_table( 'bug' );
 $t_query = "SELECT COUNT(id) FROM $t_bug_table WHERE category_id=" . db_param();

programming_language: PHP
filename: manage_proj_cat_edit_page.php
change_type: ModificationType.MODIFY
diff: @@ -55,13 +55,13 @@ auth_reauthenticate();
 $f_category_id		= gpc_get_int( 'id' );
 $f_project_id		= gpc_get_int( 'project_id' );
 
-access_ensure_project_level( config_get( 'manage_project_threshold' ), $f_project_id );
-
 $t_row = category_get_row( $f_category_id );
 $t_assigned_to = $t_row['user_id'];
 $t_project_id = $t_row['project_id'];
 $t_name = $t_row['name'];
 
+access_ensure_project_level( config_get( 'manage_project_threshold' ), $t_project_id );
+
 html_page_top();
 
 print_manage_menu( 'manage_proj_cat_edit_page.php' ); ?>

programming_language: PHP
filename: manage_proj_page.php
change_type: ModificationType.MODIFY
diff: @@ -164,20 +164,25 @@ print_manage_menu( 'manage_proj_page.php' );
 	<h2><?php echo lang_get( 'global_categories' ) ?></h2>
 	<table cellspacing="1" cellpadding="5" border="1"><?php
 		$t_categories = category_get_all_rows( ALL_PROJECTS );
+		$t_can_update_global_cat = access_has_global_level( config_get( 'manage_site_threshold' ) );
+
 		if ( count( $t_categories ) > 0 ) { ?>
 		<tr class="row-category">
 			<td><?php echo lang_get( 'category' ) ?></td>
 			<td><?php echo lang_get( 'assign_to' ) ?></td>
+			<?php if( $t_can_update_global_cat ) { ?>
 			<td class="center"><?php echo lang_get( 'actions' ) ?></td>
+			<?php } ?>
 		</tr><?php
 		}
 
-	foreach ( $t_categories as $t_category ) {
+	foreach( $t_categories as $t_category ) {
 		$t_id = $t_category['id'];
 	?>
 		<tr <?php echo helper_alternate_class() ?>>
 			<td><?php echo string_display( category_full_name( $t_id, false ) )  ?></td>
 			<td><?php echo prepare_user_name( $t_category['user_id'] ) ?></td>
+			<?php if( $t_can_update_global_cat ) { ?>
 			<td class="center">
 				<?php
 					$t_id = urlencode( $t_id );
@@ -188,10 +193,12 @@ print_manage_menu( 'manage_proj_page.php' );
 					print_button( "manage_proj_cat_delete.php?id=$t_id&project_id=$t_project_id", lang_get( 'delete_link' ) );
 				?>
 			</td>
+			<?php } ?>
 		</tr><?php
 	} # end for loop ?>
 	</table>
 
+<?php if( $t_can_update_global_cat ) { ?>
 	<form method="post" action="manage_proj_cat_add.php">
 		<fieldset>
 			<?php echo form_security_field( 'manage_proj_cat_add' ) ?>
@@ -200,6 +207,7 @@ print_manage_menu( 'manage_proj_page.php' );
 			<input type="submit" class="button" value="<?php echo lang_get( 'add_category_button' ) ?>" />
 		</fieldset>
 	</form>
+<?php } ?>
 </div>
 
 <?php

programming_language: PHP