SB2014111804 - Multiple vulnerabilities in MantisBT

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014111804

SB2014111804 - Multiple vulnerabilities in MantisBT

Published: November 18, 2014 Updated: January 3, 2021

Security Bulletin ID SB2014111804
Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2014-8987)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) Information disclosure (CVE-ID: CVE-2014-9279)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.


3) Cross-site scripting (CVE-ID: CVE-2014-9270)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-8988)

The vulnerability allows a remote #AU# to gain access to sensitive information.

MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.


5) Cross-site scripting (CVE-ID: CVE-2014-8986)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 when processing a crafted config option, a different vulnerability than CVE-2014-8987. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


6) Input validation error (CVE-ID: CVE-2014-7146)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.


Remediation

Install update from vendor's website.

References