CVE-2024-23830

Summary

CVE-2024-23830 is a vulnerability affecting the open-source issue tracker MantisBT. Before version 2.26.1, an unauthenticated attacker can hijack a user's account by manipulating the password reset link in a notification message. The attacker requires only the user's email address and username to carry out the attack. This issue poses a serious risk to user accounts, especially if weak passwords are used. The vulnerability can be mitigated by applying the patch available in version 2.26.1 or by defining an appropriate value for `$g_path` in `config_inc.php`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.