CVE-2014-8598 EXPLOIT
6.4
MEDIUM · CVSS 2.0 · EPSS 38.5% (pctl 99)
Patch early
A public exploit exists.
Description
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
Scoring
| CVSS | 6.4 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| EPSS | 38.46% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-19 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-11-18 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| mantisbt | mantisbt |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (1) | 2014-11-18 |
References
- http://secunia.com/advisories/62101
- http://www.debian.org/security/2015/dsa-3120
- http://www.mantisbt.org/bugs/view.php?id=17780
- http://www.openwall.com/lists/oss-security/2014/11/07/28
- http://www.securityfocus.com/bid/70996
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98573
- https://github.com/mantisbt/mantisbt/commit/80a15487
- http://secunia.com/advisories/62101
- http://www.debian.org/security/2015/dsa-3120
- http://www.mantisbt.org/bugs/view.php?id=17780
- http://www.openwall.com/lists/oss-security/2014/11/07/28
- http://www.securityfocus.com/bid/70996
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98573
- https://github.com/mantisbt/mantisbt/commit/80a15487
→ the Explorer · watch your stack · NVD