CVE-2014-9271: XSS

Published Jan 9, 2015

Updated

Cross-site scripting (XSS) vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.

Affected Software

40 affected components

Debian Debian Linux=7.0

MantisBT mantisbt=1.1.0-a1

MantisBT mantisbt=1.1.0-a2

MantisBT mantisbt=1.1.0-a3

MantisBT mantisbt=1.1.0-a4

MantisBT mantisbt=1.1.0-rc1

MantisBT mantisbt=1.1.0-rc2

MantisBT mantisbt=1.1.0-rc3

MantisBT mantisbt=1.1.1

MantisBT mantisbt=1.1.2

MantisBT mantisbt=1.1.3

MantisBT mantisbt=1.1.4

MantisBT mantisbt=1.1.5

MantisBT mantisbt=1.1.6

MantisBT mantisbt=1.1.7

MantisBT mantisbt=1.1.8

MantisBT mantisbt=1.1.9

MantisBT mantisbt=1.2.0

MantisBT mantisbt=1.2.0-alpha1

MantisBT mantisbt=1.2.0-alpha2

MantisBT mantisbt=1.2.0-alpha3

MantisBT mantisbt=1.2.0-rc1

MantisBT mantisbt=1.2.0-rc2

MantisBT mantisbt=1.2.1

MantisBT mantisbt=1.2.2

MantisBT mantisbt=1.2.3

MantisBT mantisbt=1.2.4

MantisBT mantisbt=1.2.5

MantisBT mantisbt=1.2.6

MantisBT mantisbt=1.2.7

MantisBT mantisbt=1.2.8

MantisBT mantisbt=1.2.9

MantisBT mantisbt=1.2.10

MantisBT mantisbt=1.2.11

MantisBT mantisbt=1.2.12

MantisBT mantisbt=1.2.13

MantisBT mantisbt=1.2.14

MantisBT mantisbt=1.2.15

MantisBT mantisbt=1.2.16

MantisBT mantisbt=1.2.17

Remediation

Patch Available

https://github.com/mantisbt/mantisbt/commit/9fb8cf36f

Event History

Jan 9, 2015

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9271?

CVE-2014-9271 has a medium severity level due to the potential for cross-site scripting attacks.

How do I fix CVE-2014-9271?

To fix CVE-2014-9271, upgrade MantisBT to version 1.2.18 or later to eliminate the vulnerability.

Who is affected by CVE-2014-9271?

CVE-2014-9271 affects users of MantisBT versions prior to 1.2.18 and certain Debian Linux 7.0 implementations.

What type of vulnerability is represented by CVE-2014-9271?

CVE-2014-9271 is classified as a cross-site scripting (XSS) vulnerability.

Can CVE-2014-9271 be exploited remotely?

Yes, CVE-2014-9271 can be exploited remotely by authenticated users to inject arbitrary web scripts.