PT-2014-8644 · Mantisbt · Mantisbt

Published 2014-11-18 · Updated 2017-09-08 · CVE-2014-8598

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.x

Description The XML Import/Export plugin does not restrict access, allowing remote attackers to upload arbitrary XML files via the import page or obtain sensitive information via the export page.

Recommendations For MantisBT versions 1.2.x, restrict access to the XML Import/Export plugin to prevent unauthorized uploads and sensitive information disclosure. As a temporary workaround, consider disabling the XML Import/Export plugin until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2014-8598

DSA-3120-1

Affected Products

Mantisbt

References · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mantisbt_php_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41685 · Exploit
• https://github.com/mantisbt/mantisbt/commit/80a15487 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/mantis · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6387 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8598 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9270 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1934 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1811 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8554 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8598 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9117 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6316 · Security Note
• https://osv.dev/vulnerability/DSA-3120-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9271 · Security Note