CVE-2017-7615

by Jeremyin Security Bulletinson Posted on

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.