CVE-2025-55155

{
  "id": "CVE-2025-55155",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-04T21:15:39.280",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2."
    },
    {
      "lang": "es",
      "value": "Mantis Bug Tracker (MantisBT) es un rastreador de problemas de código abierto. En las versiones 2.27.1 e inferiores, cuando un usuario edita su perfil para cambiar su dirección de correo electrónico, el sistema la guarda sin validar que realmente le pertenezca al usuario. Esto podría resultar en el almacenamiento de una dirección de correo electrónico no válida, impidiendo que el usuario reciba notificaciones del sistema. Las notificaciones enviadas a la dirección de correo electrónico de otra persona podrían conducir a la revelación de información. Este problema se solucionó en la versión 2.27.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mantisbt",
          "product": "mantisbt",
          "versions": [
            {
              "version": "< 2.27.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-04T21:03:02.558301Z",
          "id": "CVE-2025-55155",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        },
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.27.2",
              "matchCriteriaId": "B49EF21D-F412-4C89-BFA8-9606F204E310"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://mantisbt.org/bugs/view.php?id=36005",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}