CVE-2014-8988: Medium severity centos libreport-plugin-mantisbt vulnerability
MantisBT before 1.2.18 allows remote authenticated users to bypass the $gdownloadattachmentsthreshold and $gviewattachmentsthreshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8988?
CVE-2014-8988 is considered a moderate severity vulnerability due to its potential to allow unauthorized access to private project attachments.
How do I fix CVE-2014-8988?
To fix CVE-2014-8988, upgrade MantisBT to version 1.2.18 or later to ensure that attachment access restrictions are properly enforced.
Who is affected by CVE-2014-8988?
CVE-2014-8988 affects MantisBT versions prior to 1.2.18, specifically version 1.2.17.
What types of users can exploit CVE-2014-8988?
Remote authenticated users with access to an unrestricted project can exploit CVE-2014-8988 to access private attachments.
What are the impacts of CVE-2014-8988?
The impact of CVE-2014-8988 includes unauthorized reading of private project attachments, compromising the confidentiality of sensitive information.