Vulnerability Details CVE-2014-9279
The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 63.6%
CVSS Severity
CVSS v2 Score 5.0
References
- http://seclists.org/oss-sec/2014/q4/863
- http://www.mantisbt.org/bugs/view.php?id=17877
- http://www.securityfocus.com/bid/71359
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99031
- https://github.com/mantisbt/mantisbt/commit/0826cef8
- http://seclists.org/oss-sec/2014/q4/863
- http://www.mantisbt.org/bugs/view.php?id=17877
- http://www.securityfocus.com/bid/71359
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99031
- https://github.com/mantisbt/mantisbt/commit/0826cef8
Products affected by CVE-2014-9279
-
cpe:2.3:a:mantisbt:mantisbt:1.0.0
-
cpe:2.3:a:mantisbt:mantisbt:1.0.1
-
cpe:2.3:a:mantisbt:mantisbt:1.0.2
-
cpe:2.3:a:mantisbt:mantisbt:1.0.3
-
cpe:2.3:a:mantisbt:mantisbt:1.0.4
-
cpe:2.3:a:mantisbt:mantisbt:1.0.5
-
cpe:2.3:a:mantisbt:mantisbt:1.0.6
-
cpe:2.3:a:mantisbt:mantisbt:1.0.7
-
cpe:2.3:a:mantisbt:mantisbt:1.0.8
-
cpe:2.3:a:mantisbt:mantisbt:1.0.9
-
cpe:2.3:a:mantisbt:mantisbt:1.1.0
-
cpe:2.3:a:mantisbt:mantisbt:1.1.1
-
cpe:2.3:a:mantisbt:mantisbt:1.1.2
-
cpe:2.3:a:mantisbt:mantisbt:1.1.3
-
cpe:2.3:a:mantisbt:mantisbt:1.1.4
-
cpe:2.3:a:mantisbt:mantisbt:1.1.5
-
cpe:2.3:a:mantisbt:mantisbt:1.1.6
-
cpe:2.3:a:mantisbt:mantisbt:1.1.7
-
cpe:2.3:a:mantisbt:mantisbt:1.1.8
-
cpe:2.3:a:mantisbt:mantisbt:1.1.9
-
cpe:2.3:a:mantisbt:mantisbt:1.2.0
-
cpe:2.3:a:mantisbt:mantisbt:1.2.1
-
cpe:2.3:a:mantisbt:mantisbt:1.2.10
-
cpe:2.3:a:mantisbt:mantisbt:1.2.11
-
cpe:2.3:a:mantisbt:mantisbt:1.2.12
-
cpe:2.3:a:mantisbt:mantisbt:1.2.13
-
cpe:2.3:a:mantisbt:mantisbt:1.2.14
-
cpe:2.3:a:mantisbt:mantisbt:1.2.15
-
cpe:2.3:a:mantisbt:mantisbt:1.2.16
-
cpe:2.3:a:mantisbt:mantisbt:1.2.17