CVE-2014-9269: XSS

Published Jan 9, 2015

Updated

Cross-site scripting (XSS) vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.

Affected Software

42 affected components

MantisBT mantisbt=1.1.0-a1

MantisBT mantisbt=1.1.0-a2

MantisBT mantisbt=1.1.0-a3

MantisBT mantisbt=1.1.0-a4

MantisBT mantisbt=1.1.0-rc1

MantisBT mantisbt=1.1.0-rc2

MantisBT mantisbt=1.1.0-rc3

MantisBT mantisbt=1.1.1

MantisBT mantisbt=1.1.2

MantisBT mantisbt=1.1.3

MantisBT mantisbt=1.1.4

MantisBT mantisbt=1.1.5

MantisBT mantisbt=1.1.6

MantisBT mantisbt=1.1.7

MantisBT mantisbt=1.1.8

MantisBT mantisbt=1.1.9

MantisBT mantisbt=1.2.0

MantisBT mantisbt=1.2.0-alpha1

MantisBT mantisbt=1.2.0-alpha2

MantisBT mantisbt=1.2.0-alpha3

MantisBT mantisbt=1.2.0-rc1

MantisBT mantisbt=1.2.0-rc2

MantisBT mantisbt=1.2.0a1

MantisBT mantisbt=1.2.0a2

MantisBT mantisbt=1.2.1

MantisBT mantisbt=1.2.2

MantisBT mantisbt=1.2.3

MantisBT mantisbt=1.2.4

MantisBT mantisbt=1.2.5

MantisBT mantisbt=1.2.6

MantisBT mantisbt=1.2.7

MantisBT mantisbt=1.2.8

MantisBT mantisbt=1.2.9

MantisBT mantisbt=1.2.10

MantisBT mantisbt=1.2.11

MantisBT mantisbt=1.2.12

MantisBT mantisbt=1.2.13

MantisBT mantisbt=1.2.14

MantisBT mantisbt=1.2.15

MantisBT mantisbt=1.2.16

MantisBT mantisbt=1.2.17

Debian Debian Linux=7.0

Event History

Jan 9, 2015

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9269?

CVE-2014-9269 has been rated as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2014-9269?

To mitigate CVE-2014-9269, upgrade MantisBT to version 1.2.18 or later, where the vulnerability has been patched.

What does CVE-2014-9269 exploit?

CVE-2014-9269 exploits a cross-site scripting vulnerability in MantisBT's helper_api.php when the Extended project browser is enabled.

Which versions of MantisBT are affected by CVE-2014-9269?

CVE-2014-9269 affects MantisBT versions from 1.1.0a1 through 1.2.x prior to 1.2.18.

Can CVE-2014-9269 be exploited remotely?

Yes, CVE-2014-9269 can be exploited remotely by attackers using crafted project cookies to inject malicious scripts.