CVE-2014-8598
medium · 6.4The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
6.4
CVSS
38.5%
EPSS (exploit prob.)
99th
EPSS percentile
2014-11-18
Published
AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-19
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| mantisbt | mantisbt | <= 1.2.17 |
Check a specific version with /api/v1/cve/match.
References
- http://secunia.com/advisories/62101
- http://www.debian.org/security/2015/dsa-3120
- http://www.mantisbt.org/bugs/view.php?id=17780
- http://www.openwall.com/lists/oss-security/2014/11/07/28
- http://www.securityfocus.com/bid/70996
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98573
- https://github.com/mantisbt/mantisbt/commit/80a15487
- http://secunia.com/advisories/62101
- http://www.debian.org/security/2015/dsa-3120
- http://www.mantisbt.org/bugs/view.php?id=17780
- http://www.openwall.com/lists/oss-security/2014/11/07/28
- http://www.securityfocus.com/bid/70996
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98573
- https://github.com/mantisbt/mantisbt/commit/80a15487
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-8598