CVEvulnerability
CVE-2014-8598
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-11-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-19
Description
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
Affected configurations
• mantisbt mantisbt (<= 1.2.17)
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/62101 secunia.com
- http://www.debian.org/security/2015/dsa-3120 www.debian.org
- http://www.mantisbt.org/bugs/view.php?id=17780 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/11/07/28 www.openwall.com
- http://www.securityfocus.com/bid/70996 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98573 exchange.xforce.ibmcloud.com
- https://github.com/mantisbt/mantisbt/commit/80a15487 Vendor Advisory
- http://secunia.com/advisories/62101 secunia.com
- http://www.debian.org/security/2015/dsa-3120 www.debian.org
- http://www.mantisbt.org/bugs/view.php?id=17780 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/11/07/28 www.openwall.com
- http://www.securityfocus.com/bid/70996 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98573 exchange.xforce.ibmcloud.com
- https://github.com/mantisbt/mantisbt/commit/80a15487 Vendor Advisory