CVE-2008-4688: Mantis

Medium severity, CVSS 5.0. EPSS: 11.7% chance of exploitation in the next 30 days.

core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.

Affected products

• Mantis Mantis: up to and including 1.1.3; version 0.19.3 only; version 0.19.4 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; …

Published 2008-10-22. Last modified 2026-06-16.