A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (moveattachmentspage.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php.

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Below issues are reported for all versions of MantisBT:

CVE-2014-9571: XSS in install.php [1] CVE-2014-9572: Improper Access Control in install.php [2] CVE-2014-9573: SQL Injection in manageuserpage.php [3] CVE-2014-9624: CAPTCHA bypass in MantisBT [4]

[1]: http://seclists.org/oss-sec/2015/q1/156 [2]: http://seclists.org/oss-sec/2015/q1/158 [3]: http://seclists.org/oss-sec/2015/q1/157 [4]: http://seclists.org/oss-sec/2015/q1/160

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie.

CAPTCHA bypass vulnerability in MantisBT before 1.2.19.