Lucene search
MitreCVE-2014-8598HistoryNov 18, 2014 - 3:59 p.m.
CVE-2014-8598
2014-11-1815:59:06
CWE-19
mitre
web.nvd.nist.gov
36
mantisbt
xml import
xml export
remote attackers
arbitrary upload
sensitive information
cve-2014-8598
nvd
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
AI Score
5.9
Confidence
High
EPSS
0.353
Percentile
97.2%
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
Affected configurations
Node
mantisbtmantisbtRange≤1.2.17
Related
prion
prion
Code injection
2014-11-18 15:59:00
Code injection
2014-11-18 15:59:00
metasploit
metasploit
MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability
2014-11-09 13:00:44
zdt
zdt
MantisBT XmlImportExport Plugin PHP Code Injection Exploit
2014-11-16 00:00:00
MantisBT XmlImportExport Plugin PHP Code Injection Exploit
2014-11-18 00:00:00
ubuntucve
ubuntucve
CVE-2014-8598
2014-11-18 00:00:00
CVE-2014-7146
2014-11-18 00:00:00
nvd
nvd
CVE-2014-8598
2014-11-18 15:59:06
CVE-2014-7146
2014-11-18 15:59:02
archlinux
archlinux
mantisbt: arbitrary code execution and unrestricted access
2014-11-12 00:00:00
cvelist
cvelist
CVE-2014-8598
2014-11-18 15:00:00
CVE-2014-7146
2014-11-18 15:00:00
exploitdb
exploitdb
fedora
fedora
[SECURITY] Fedora 21 Update: mantis-1.2.17-4.fc21
2014-12-12 04:21:50
[SECURITY] Fedora 20 Update: mantis-1.2.17-4.fc20
2014-12-12 04:30:46
[SECURITY] Fedora 21 Update: mantis-1.2.19-1.fc21
2015-02-07 04:03:22
nessus
nessus
Fedora 19 : mantis-1.2.17-4.fc19 (2014-15079)
2014-12-15 00:00:00
Fedora 20 : mantis-1.2.17-4.fc20 (2014-15108)
2014-12-15 00:00:00
Fedora 21 : mantis-1.2.17-4.fc21 (2014-15142)
2014-12-15 00:00:00
openvas
openvas
Fedora Update for mantis FEDORA-2014-15142
2015-01-05 00:00:00
Fedora Update for mantis FEDORA-2014-15108
2014-12-12 00:00:00
Fedora Update for mantis FEDORA-2015-1419
2015-02-07 00:00:00
cve
cve
CVE-2014-7146
2014-11-18 15:59:02
packetstorm
packetstorm
Mantis Bug Tracker 1.2.17 PHP Code Injection
2014-12-31 00:00:00
MantisBT XmlImportExport Plugin PHP Code Injection
2014-11-18 00:00:00
securityvulns
securityvulns
debian
debian
[SECURITY] [DSA 3120-1] mantis security update
2015-01-06 20:35:26
osv
osv
mantis - security update
2015-01-06 00:00:00
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
AI Score
5.9
Confidence
High
EPSS
0.353
Percentile
97.2%
Related for CVE-2014-8598