CVE-2014-9572: High severity MantisBT mantisbt vulnerability
Published Jan 26, 2015
·Updated
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.
Affected Software
2 affected components
MantisBT mantisbt<=1.2.18
MantisBT mantisbt=1.3.0-beta1
Event History
Jan 26, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9572?
CVE-2014-9572 is considered a medium severity vulnerability due to the risk of exposing sensitive database credentials.
2
How do I fix CVE-2014-9572?
To fix CVE-2014-9572, upgrade MantisBT to version 1.2.19 or later, or 1.3.0-beta.2 or later.
3
What systems are affected by CVE-2014-9572?
CVE-2014-9572 affects MantisBT versions prior to 1.2.19 and 1.3.0-beta.2.
4
What does CVE-2014-9572 allow an attacker to do?
CVE-2014-9572 allows remote attackers to obtain database credentials by accessing the exposed install.php script.
5
Is there a workaround for CVE-2014-9572?
A temporary workaround for CVE-2014-9572 is to restrict access to the /install.php file on the server.