MantisBT XmlImportExport Plugin CVE-2014-8598 Multiple Security Bypass Vulnerabilities
BID:70996
Info
MantisBT XmlImportExport Plugin CVE-2014-8598 Multiple Security Bypass Vulnerabilities
| Bugtraq ID: | 70996 |
| Class: | Design Error |
| CVE: |
CVE-2014-8598 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2014 12:00AM |
| Updated: | Apr 13 2015 10:13PM |
| Credit: | Damien Regad |
| Vulnerable: |
Mantisbt Mantisbt 1.2.17 Mantisbt Mantisbt 1.2.16 Mantisbt Mantisbt 1.2.15 Mantisbt Mantisbt 1.2.14 Mantisbt Mantisbt 1.2.13 Mantisbt Mantisbt 1.2.12 Mantisbt Mantisbt 1.2.11 Mantisbt Mantisbt 1.2.10 Mantisbt Mantisbt 1.2.9 Mantisbt Mantisbt 1.2.8 Mantisbt Mantisbt 1.2.7 Mantisbt Mantisbt 1.2.6 Mantisbt Mantisbt 1.2.4 Mantisbt Mantisbt 1.2.3 Mantisbt Mantisbt 1.2 RC2 Mantisbt Mantisbt 1.2 RC1 Mantisbt Mantisbt 1.1.8 Mantisbt Mantisbt 1.1.7 Mantisbt Mantisbt 1.1.5 Mantisbt Mantisbt 1.1 rc3 Mantisbt Mantisbt 1.0.8 Mantisbt Mantisbt 1.0.7 Mantisbt Mantisbt 1.0.6 Mantisbt Mantisbt 1.0 RC3 Mantisbt Mantisbt 1.0 rc2 Mantisbt Mantisbt 1.0 RC1 Mantisbt Mantisbt 1.0 Mantisbt Mantisbt 0.19.5 Mantisbt Mantisbt 0.19.4 Mantisbt Mantisbt 0.19.3 Mantisbt Mantisbt 0.19.2 Mantisbt Mantisbt 0.19 Mantisbt Mantisbt 0.18 Mantisbt Mantisbt 1.2.5 Mantisbt Mantisbt 1.2.2 Mantisbt Mantisbt 1.2.1 Mantisbt Mantisbt 1.2.0rc1 Mantisbt Mantisbt 1.2.0 A3 Mantisbt Mantisbt 1.2.0 A2 Mantisbt Mantisbt 1.2.0 A1 Mantisbt Mantisbt 1.1.9 Mantisbt Mantisbt 1.1.6 Mantisbt Mantisbt 1.1.4 Mantisbt Mantisbt 1.1.3 Mantisbt Mantisbt 1.1.2 Mantisbt Mantisbt 1.1.1 Mantisbt Mantisbt 1.1.0 Rc2 Mantisbt Mantisbt 1.1.0 Rc1 Mantisbt Mantisbt 1.1.0 A4 Mantisbt Mantisbt 1.1.0 A3 Mantisbt Mantisbt 1.1.0 A2 Mantisbt Mantisbt 1.1.0 A1 Mantisbt Mantisbt 1.1.0 Mantisbt Mantisbt 1.0.9 Mantisbt Mantisbt 1.0.5 Mantisbt Mantisbt 1.0.4 Mantisbt Mantisbt 1.0.3 Mantisbt Mantisbt 1.0.2 Mantisbt Mantisbt 1.0.1 Mantisbt Mantisbt 1.0.0 RC5 Mantisbt Mantisbt 1.0.0 Rc4 Mantisbt Mantisbt 1.0.0 A3 Mantisbt Mantisbt 1.0.0 A2 Mantisbt Mantisbt 1.0.0 A1 Mantisbt Mantisbt 0.19.1 Mantisbt Mantisbt 0.19.0 Rc1 Mantisbt Mantisbt 0.19.0 A2 Mantisbt Mantisbt 0.19.0 A1 Mantisbt Mantis 1.2.0rc1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Mantisbt Mantisbt 1.2.18 |
Discussion
MantisBT XmlImportExport Plugin CVE-2014-8598 Multiple Security Bypass Vulnerabilities
The XmlImportExport plugin for MantisBT is prone to multiple security-bypass vulnerabilities.
An attacker can leverage these issues to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.
The XmlImportExport plugin for MantisBT is prone to multiple security-bypass vulnerabilities.
An attacker can leverage these issues to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.
Exploit / POC
MantisBT XmlImportExport Plugin CVE-2014-8598 Multiple Security Bypass Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
MantisBT XmlImportExport Plugin CVE-2014-8598 Multiple Security Bypass Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
MantisBT XmlImportExport Plugin CVE-2014-8598 Multiple Security Bypass Vulnerabilities
References:
References:
- MantisBT Homepage (MantisBT)
- XML plugin should restrict ability to import data (Edigio Romano)
- XML plugin: Add config page with access thresholds (Edigio Romano)