CVE-2025-46556mediumCWE-770

CVE-2025-46556: fallo de gravedad media en mantisbt

MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear mantisbt+ Monitorear mantisbt/mantisbt

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters) due to a lack of server-side validation of note length. Once such a note is added, the activity stream UI fails to render; therefore, new notes cannot be displayed, effectively breaking all future collaboration on the issue. This issue is fixed in version 2.27.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
mantisbt · mantisbt
CVEs relacionadas — mantisbt

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-30849CRITICALMantisBT SOAP API has an authentication bypass vulnerability on MySQLEPSS 1.8%CVE-2024-34077HIGHMantisBT user account takeover in the signup/reset password processEPSS 1.2%CVE-2024-23830HIGHMantisBT Host Header Injection vulnerabilityEPSS 1.0%CVE-2023-44394MEDIUMDisclosure of project names to unauthorized users in MantisBTEPSS 0.7%CVE-2024-34080MEDIUMMantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.7%CVE-2026-47156CRITICALMantisBT: SOAP API Authentication Bypass with Privilege Escalation to AdministratorEPSS 0.7%