CVE-2019-15715: MantisBT Remote Code Execution
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.22.1 - Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 1.3.20
Event History
Frequently Asked Questions
What is CVE-2019-15715?
CVE-2019-15715 is a vulnerability in MantisBT versions before 1.3.20 and 2.22.1 that allows Post Authentication Command Injection, leading to Remote Code Execution.
How severe is CVE-2019-15715?
CVE-2019-15715 has a severity score of 7.2, which is considered high.
How does CVE-2019-15715 affect MantisBT?
CVE-2019-15715 affects MantisBT versions before 1.3.20 and 2.22.1, allowing Post Authentication Command Injection, leading to Remote Code Execution.
How can I fix CVE-2019-15715?
To fix CVE-2019-15715, upgrade MantisBT to version 1.3.20 or 2.22.1 or later.
Where can I find more information about CVE-2019-15715?
More information about CVE-2019-15715 can be found at the following references: [Link 1](http://packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html), [Link 2](https://github.com/mantisbt/mantisbt/commit/5fb979604d88c630343b3eaf2b435cd41918c501), [Link 3](https://github.com/mantisbt/mantisbt/commit/7092573fac31eff41823f13540324db167c8bd52).