CVE-2014-1608: SQL Injection
SQL injection issues were discovered in MantisBT, an open source issue tracker.
CVE-2014-1608 patch: https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102
CVE-2014-1609 patch: https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f
It was reported that versions 1.1.0a4 to 1.2.15 are affected.
References: http://www.ocert.org/advisories/ocert-2014-001.html
Other sources
SQL injection vulnerability in the mcifileget function in api/soap/mcfileapi.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mcissueattachmentget SOAP request.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 1.2.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2014-1608 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2014-1609
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1608?
CVE-2014-1608 is classified as a medium severity vulnerability due to SQL injection risks.
How do I fix CVE-2014-1608?
To fix CVE-2014-1608, upgrade MantisBT to the latest version that addresses the vulnerability.
What software versions are affected by CVE-2014-1608?
CVE-2014-1608 affects MantisBT versions up to 1.2.15, including several earlier releases.
What impact does CVE-2014-1608 have on systems?
CVE-2014-1608 can allow attackers to execute arbitrary SQL commands, potentially compromising the database.
Is there a patch available for CVE-2014-1608?
Yes, a patch for CVE-2014-1608 has been released and is available in the latest version of MantisBT.