CVE-2014-9270: XSS

Published Dec 8, 2014

Updated

Cross-site scripting (XSS) vulnerability in the projaxarrayserializeforautocomplete function in core/projaxapi.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field.

Affected Software

47 affected components

MantisBT mantisbt=1.0.0-a3

MantisBT mantisbt=1.0.0-rc1

MantisBT mantisbt=1.0.0-rc2

MantisBT mantisbt=1.0.0-rc3

MantisBT mantisbt=1.0.0-rc4

MantisBT mantisbt=1.0.0-rc5

MantisBT mantisbt=1.0.1

MantisBT mantisbt=1.0.2

MantisBT mantisbt=1.0.3

MantisBT mantisbt=1.0.4

MantisBT mantisbt=1.0.5

MantisBT mantisbt=1.0.6

MantisBT mantisbt=1.0.7

MantisBT mantisbt=1.0.8

MantisBT mantisbt=1.0.9

MantisBT mantisbt=1.1.0

MantisBT mantisbt=1.1.0-a1

MantisBT mantisbt=1.1.0-a2

MantisBT mantisbt=1.1.0-a3

MantisBT mantisbt=1.1.0-a4

MantisBT mantisbt=1.1.0-rc1

MantisBT mantisbt=1.1.0-rc2

MantisBT mantisbt=1.1.0-rc3

MantisBT mantisbt=1.1.1

MantisBT mantisbt=1.1.2

MantisBT mantisbt=1.1.3

MantisBT mantisbt=1.1.4

MantisBT mantisbt=1.1.5

MantisBT mantisbt=1.1.6

MantisBT mantisbt=1.1.7

MantisBT mantisbt=1.1.8

MantisBT mantisbt=1.1.9

MantisBT mantisbt=1.2.0

MantisBT mantisbt=1.2.0-alpha1

MantisBT mantisbt=1.2.0-alpha2

MantisBT mantisbt=1.2.0-alpha3

MantisBT mantisbt=1.2.0-rc1

MantisBT mantisbt=1.2.0-rc2

MantisBT mantisbt=1.2.1

MantisBT mantisbt=1.2.10

MantisBT mantisbt=1.2.11

MantisBT mantisbt=1.2.12

MantisBT mantisbt=1.2.13

MantisBT mantisbt=1.2.14

MantisBT mantisbt=1.2.15

MantisBT mantisbt=1.2.16

MantisBT mantisbt=1.2.17

Event History

Dec 8, 2014

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9270?

CVE-2014-9270 has a moderate severity level due to the presence of cross-site scripting (XSS) vulnerabilities.

How do I fix CVE-2014-9270?

To fix CVE-2014-9270, you should upgrade MantisBT to a version that has patched the vulnerability, such as 1.2.18 or later.

What versions of MantisBT are affected by CVE-2014-9270?

CVE-2014-9270 affects MantisBT versions 1.1.0a3 through 1.2.17.

Can CVE-2014-9270 be exploited remotely?

Yes, CVE-2014-9270 can be exploited remotely by attackers to inject arbitrary web script or HTML.

What are the potential impacts of CVE-2014-9270?

The potential impacts of CVE-2014-9270 include data theft, session hijacking, or unauthorized actions on behalf of a user.