Improper input validation in Mantisbt
CVE-2014-7146
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.804 (99.1th percentile) — read the EPSS interpretation.
Affected products
- Mantisbt — versions 1.2.17
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 70993 (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- mantisbt-cve20147146-code-exec(98572) (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- 62101 (x_refsource_SECUNIA, third-party-advisory)
- [oss-security] 20141108 CVE-2014-7146: MantisBT XmlImportExport plugin PHP Code Injection Vulnerability (mailing-list, x_refsource_MLIST)
- DSA-3120 (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2014-7146?
- CVE-2014-7146 is a vulnerability in Mantisbt, classified under Improper Input Validation. Published 2014-11-18.
- Is CVE-2014-7146 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.