CVE-2014-2238: SQL Injection
SQL injection vulnerability in the manage configuration page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2238?
CVE-2014-2238 is rated as a high severity SQL injection vulnerability that can be exploited by authenticated remote administrators.
How do I fix CVE-2014-2238?
To fix CVE-2014-2238, upgrade MantisBT to version 1.2.17 or later to mitigate the vulnerability.
What impact does CVE-2014-2238 have on affected systems?
CVE-2014-2238 can allow authenticated remote administrators to execute arbitrary SQL commands on the database.
Which versions of MantisBT are affected by CVE-2014-2238?
Versions 1.2.13 through 1.2.16 of MantisBT are affected by CVE-2014-2238.
Who can exploit CVE-2014-2238?
Only authenticated remote administrators can exploit CVE-2014-2238 due to its reliance on the permissions associated with admin access.