PT-2014-8644 · Mantisbt · Mantisbt

Publicado 2014-11-18 · Atualizado 2017-09-08 · CVE-2014-8598

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.x

Description The XML Import/Export plugin does not restrict access, allowing remote attackers to upload arbitrary XML files via the import page or obtain sensitive information via the export page.

Recommendations For MantisBT versions 1.2.x, restrict access to the XML Import/Export plugin to prevent unauthorized uploads and sensitive information disclosure. As a temporary workaround, consider disabling the XML Import/Export plugin until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

CVE-2014-8598

DSA-3120-1

Produtos afetados

Mantisbt

Referências · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mantisbt_php_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41685 · Exploit
• https://github.com/mantisbt/mantisbt/commit/80a15487 · Aviso do Fabricante
• https://github.com/mantisbt/mantisbt/commit/0002d106a6cd35cb0a6fe03246531a4e3f32c9d0#diff-4122320b011a3291cd45da074a867076 · Nota
• https://github.com/mantisbt/mantisbt/commit/599364b2 · Nota
• https://security-tracker.debian.org/tracker/source-package/mantis · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6387 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-8598 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/11/07/28 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9270 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1934 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1811 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8554 · Nota de Segurança
• https://packages.debian.org/src:mantis · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8598 · Nota de Segurança