CVE-2014-9701: XSS
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php.
Other sources
MantisBT's permalinkpage.php builds a permanent link to a configured filter. Using a crafted URL, an attacker can make this link execute arbitrary JavaScript code in the user's browser.
Upstream patches:
https://github.com/mantisbt/mantisbt/commit/d95f070d (1.2.x) https://github.com/mantisbt/mantisbt/commit/e7e2b550 (1.3.x)
Additional information (along with a link to upstream issues):
http://seclists.org/oss-sec/2015/q1/842
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9701?
CVE-2014-9701 has a medium severity level due to its cross-site scripting (XSS) risks.
How do I fix CVE-2014-9701?
To fix CVE-2014-9701, upgrade MantisBT to version 1.2.19 or 1.3.0-beta.2 or later.
What software is affected by CVE-2014-9701?
CVE-2014-9701 affects MantisBT versions prior to 1.2.19 and 1.3.0-beta.2.
What type of vulnerability is CVE-2014-9701?
CVE-2014-9701 is a cross-site scripting (XSS) vulnerability.
How can attackers exploit CVE-2014-9701?
Attackers can exploit CVE-2014-9701 by injecting arbitrary web scripts or HTML into the url parameter of permalink_page.php.