CVE-2014-9571: XSS
Below issues are reported for all versions of MantisBT:
CVE-2014-9571: XSS in install.php [1] CVE-2014-9572: Improper Access Control in install.php [2] CVE-2014-9573: SQL Injection in manageuserpage.php [3] CVE-2014-9624: CAPTCHA bypass in MantisBT [4]
[1]: http://seclists.org/oss-sec/2015/q1/156 [2]: http://seclists.org/oss-sec/2015/q1/158 [3]: http://seclists.org/oss-sec/2015/q1/157 [4]: http://seclists.org/oss-sec/2015/q1/160
Other sources
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) adminusername or (2) adminpassword parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9571?
CVE-2014-9571 is classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2014-9571?
To fix CVE-2014-9571, upgrade MantisBT to version 1.2.19 or later.
Which versions of MantisBT are affected by CVE-2014-9571?
CVE-2014-9571 affects all versions of MantisBT prior to 1.2.19.
What types of vulnerabilities does CVE-2014-9571 include?
CVE-2014-9571 is an XSS vulnerability found in the install.php file of MantisBT.
Can CVE-2014-9571 lead to data exposure?
Yes, CVE-2014-9571 can potentially lead to data exposure through executed malicious scripts in the user's browser.