Lucene search
HistoryNov 13, 2014 - 9:32 p.m.
CVE-2014-8554
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
6.5
Confidence
High
EPSS
0.009
Percentile
82.5%
SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
Affected configurations
Node
mantisbtmantisbtRange≤1.2.17
ORmantisbtmantisbtMatch0.18.0
ORmantisbtmantisbtMatch0.19.0
ORmantisbtmantisbtMatch0.19.0a1
ORmantisbtmantisbtMatch0.19.0a2
ORmantisbtmantisbtMatch0.19.0rc1
ORmantisbtmantisbtMatch0.19.0a1
ORmantisbtmantisbtMatch0.19.0a2
ORmantisbtmantisbtMatch0.19.1
ORmantisbtmantisbtMatch0.19.2
ORmantisbtmantisbtMatch0.19.3
ORmantisbtmantisbtMatch0.19.4
ORmantisbtmantisbtMatch0.19.5
ORmantisbtmantisbtMatch1.0.0
ORmantisbtmantisbtMatch1.0.0a1
ORmantisbtmantisbtMatch1.0.0a2
ORmantisbtmantisbtMatch1.0.0a3
ORmantisbtmantisbtMatch1.0.0rc1
ORmantisbtmantisbtMatch1.0.0rc2
ORmantisbtmantisbtMatch1.0.0rc3
ORmantisbtmantisbtMatch1.0.0rc4
ORmantisbtmantisbtMatch1.0.0rc5
ORmantisbtmantisbtMatch1.0.0a1
ORmantisbtmantisbtMatch1.0.0a2
ORmantisbtmantisbtMatch1.0.0a3
ORmantisbtmantisbtMatch1.0.1
ORmantisbtmantisbtMatch1.0.2
ORmantisbtmantisbtMatch1.0.3
ORmantisbtmantisbtMatch1.0.4
ORmantisbtmantisbtMatch1.0.5
ORmantisbtmantisbtMatch1.0.6
ORmantisbtmantisbtMatch1.0.7
ORmantisbtmantisbtMatch1.0.8
ORmantisbtmantisbtMatch1.0.9
ORmantisbtmantisbtMatch1.1.0
ORmantisbtmantisbtMatch1.1.0a1
ORmantisbtmantisbtMatch1.1.0a2
ORmantisbtmantisbtMatch1.1.0a3
ORmantisbtmantisbtMatch1.1.0a4
ORmantisbtmantisbtMatch1.1.0rc1
ORmantisbtmantisbtMatch1.1.0rc2
ORmantisbtmantisbtMatch1.1.0rc3
ORmantisbtmantisbtMatch1.1.1
ORmantisbtmantisbtMatch1.1.2
ORmantisbtmantisbtMatch1.1.3
ORmantisbtmantisbtMatch1.1.4
ORmantisbtmantisbtMatch1.1.5
ORmantisbtmantisbtMatch1.1.6
ORmantisbtmantisbtMatch1.1.7
ORmantisbtmantisbtMatch1.1.8
ORmantisbtmantisbtMatch1.1.9
ORmantisbtmantisbtMatch1.2.0
ORmantisbtmantisbtMatch1.2.0alpha1
ORmantisbtmantisbtMatch1.2.0alpha2
ORmantisbtmantisbtMatch1.2.0alpha3
ORmantisbtmantisbtMatch1.2.0rc1
ORmantisbtmantisbtMatch1.2.0rc2
ORmantisbtmantisbtMatch1.2.0a1
ORmantisbtmantisbtMatch1.2.0a2
ORmantisbtmantisbtMatch1.2.1
ORmantisbtmantisbtMatch1.2.2
ORmantisbtmantisbtMatch1.2.3
ORmantisbtmantisbtMatch1.2.4
ORmantisbtmantisbtMatch1.2.5
ORmantisbtmantisbtMatch1.2.6
ORmantisbtmantisbtMatch1.2.7
ORmantisbtmantisbtMatch1.2.8
ORmantisbtmantisbtMatch1.2.9
ORmantisbtmantisbtMatch1.2.10
ORmantisbtmantisbtMatch1.2.11
ORmantisbtmantisbtMatch1.2.12
ORmantisbtmantisbtMatch1.2.13
ORmantisbtmantisbtMatch1.2.14
ORmantisbtmantisbtMatch1.2.15
ORmantisbtmantisbtMatch1.2.16
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mantisbt | mantisbt | * | cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.18.0 | cpe:2.3:a:mantisbt:mantisbt:0.18.0:*:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.0 | cpe:2.3:a:mantisbt:mantisbt:0.19.0:*:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.0 | cpe:2.3:a:mantisbt:mantisbt:0.19.0:a1:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.0 | cpe:2.3:a:mantisbt:mantisbt:0.19.0:a2:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.0 | cpe:2.3:a:mantisbt:mantisbt:0.19.0:rc1:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.0a1 | cpe:2.3:a:mantisbt:mantisbt:0.19.0a1:*:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.0a2 | cpe:2.3:a:mantisbt:mantisbt:0.19.0a2:*:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.1 | cpe:2.3:a:mantisbt:mantisbt:0.19.1:*:*:*:*:*:*:* |
| mantisbt | mantisbt | 0.19.2 | cpe:2.3:a:mantisbt:mantisbt:0.19.2:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2014-8554
2014-11-13 15:00:00
CVE-2014-1609
2014-03-20 16:00:00
prion
prion
Sql injection
2014-11-13 21:32:00
Sql injection
2014-03-20 16:55:00
ubuntucve
ubuntucve
CVE-2014-8554
2014-11-13 00:00:00
CVE-2014-1609
2014-03-20 00:00:00
cve
cve
CVE-2014-8554
2014-11-13 21:32:11
CVE-2014-1609
2014-03-20 16:55:12
openvas
openvas
Fedora Update for mantis FEDORA-2014-15142
2015-01-05 00:00:00
Fedora Update for mantis FEDORA-2014-15108
2014-12-12 00:00:00
MantisBT < 1.2.16 Multiple SQLi Vulnerabilities
2014-03-25 00:00:00
nessus
nessus
Fedora 19 : mantis-1.2.17-4.fc19 (2014-15079)
2014-12-15 00:00:00
Fedora 20 : mantis-1.2.17-4.fc20 (2014-15108)
2014-12-15 00:00:00
MantisBT 1.1.x < 1.2.18 Multiple Vulnerabilities
2015-02-18 00:00:00
archlinux
archlinux
mantisbt: sql injection
2014-11-05 00:00:00
nvd
nvd
CVE-2014-1609
2014-03-20 16:55:12
securityvulns
securityvulns
[SECURITY] [DSA 3030-1] mantis security update
2014-10-14 00:00:00
[oCERT-2014-001] MantisBT input sanitization errors
2014-02-11 00:00:00
debian
debian
[SECURITY] [DSA 3030-1] mantis security update
2014-09-20 21:26:14
[SECURITY] [DSA 3120-1] mantis security update
2015-01-06 20:35:26
fedora
fedora
[SECURITY] Fedora 20 Update: mantis-1.2.17-1.fc20
2014-03-13 05:07:18
[SECURITY] Fedora 21 Update: mantis-1.2.17-4.fc21
2014-12-12 04:21:50
[SECURITY] Fedora 20 Update: mantis-1.2.17-4.fc20
2014-12-12 04:30:46
osv
osv
mantis - security update
2015-01-06 00:00:00
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
6.5
Confidence
High
EPSS
0.009
Percentile
82.5%
Related for NVD:CVE-2014-8554