MantisBT CVE-2014-1609 Multiple Unspecified SQL Injection Vulnerabilities

Bugtraq ID:	65461
Class:	Input Validation Error
CVE:	CVE-2014-1609
Remote:	Yes
Local:	No
Published:	Feb 11 2014 12:00AM
Updated:	Apr 13 2015 09:20PM
Credit:	Martin Herfurt
Vulnerable:	Mantisbt Mantisbt 1.2.15 Mantisbt Mantisbt 1.2.14 Mantisbt Mantisbt 1.2.13 Mantisbt Mantisbt 1.2.12 Mantisbt Mantisbt 1.2.11 Mantisbt Mantisbt 1.2.10 Mantisbt Mantisbt 1.2.9 Mantisbt Mantisbt 1.2.8 Mantisbt Mantisbt 1.2.7 Mantisbt Mantisbt 1.2.6 Mantisbt Mantisbt 1.2.4 Mantisbt Mantisbt 1.2.3 Mantisbt Mantisbt 1.1.8 Mantisbt Mantisbt 1.1.7 Mantisbt Mantisbt 1.1.5 Mantisbt Mantisbt 1.2.5 Mantisbt Mantisbt 1.2.2 Mantisbt Mantisbt 1.2.1 Mantisbt Mantisbt 1.1.9 Mantisbt Mantisbt 1.1.6 Mantisbt Mantisbt 1.1.4 Mantisbt Mantisbt 1.1.3 Mantisbt Mantisbt 1.1.2 Mantisbt Mantisbt 1.1.1 Mantisbt Mantisbt 1.1.0 A4 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Mantisbt Mantisbt 1.2.16

MantisBT CVE-2014-1609 Multiple Unspecified SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

MantisBT CVE-2014-1609 Multiple Unspecified SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MantisBT CVE-2014-1609 Multiple Unspecified SQL Injection Vulnerabilities

References:

• #2014-001 MantisBT input sanitization errors (oCERT)
  
• 0016880: CVE-2014-1609: SQL injection vulnerabilities (MantisBT Team)
  
• Fix CVE-2014-1609: SQL injection vulnerabilities (dregad)
  
• MantisBT Homepage (MantisBT)