VulnerabilityModified
CVE-2014-9573
SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.
MEDIUM 6.0EPSS 1.40%
Does this matter?
Lower severity and a low EPSS score (1.40%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 1.40% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- mantisbt/mantisbt
- Source
- cve@mitre.org
References
- http://seclists.org/oss-sec/2015/q1/157Exploit
- http://www.securitytracker.com/id/1031633
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100210
- https://github.com/mantisbt/mantisbt/commit/69c2d28d
- https://github.com/mantisbt/mantisbt/commit/7cc4539f
- https://www.htbridge.com/advisory/HTB23243
- https://www.mantisbt.org/bugs/view.php?id=17937
- https://www.mantisbt.org/bugs/view.php?id=17940Exploit
- http://seclists.org/oss-sec/2015/q1/157Exploit
- http://www.securitytracker.com/id/1031633
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100210
- https://github.com/mantisbt/mantisbt/commit/69c2d28d
- https://github.com/mantisbt/mantisbt/commit/7cc4539f
- https://www.htbridge.com/advisory/HTB23243
- https://www.mantisbt.org/bugs/view.php?id=17937
- https://www.mantisbt.org/bugs/view.php?id=17940Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.