Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-9271

Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.

Published

2015-01-09T18:59:02.587

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	debian	debian_linux	7.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.0	Yes
Application	mantisbt	mantisbt	1.1.1	Yes
Application	mantisbt	mantisbt	1.1.2	Yes
Application	mantisbt	mantisbt	1.1.3	Yes
Application	mantisbt	mantisbt	1.1.4	Yes
Application	mantisbt	mantisbt	1.1.5	Yes
Application	mantisbt	mantisbt	1.1.6	Yes
Application	mantisbt	mantisbt	1.1.7	Yes
Application	mantisbt	mantisbt	1.1.8	Yes
Application	mantisbt	mantisbt	1.1.9	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.0	Yes
Application	mantisbt	mantisbt	1.2.1	Yes
Application	mantisbt	mantisbt	1.2.2	Yes
Application	mantisbt	mantisbt	1.2.3	Yes
Application	mantisbt	mantisbt	1.2.4	Yes
Application	mantisbt	mantisbt	1.2.5	Yes
Application	mantisbt	mantisbt	1.2.6	Yes
Application	mantisbt	mantisbt	1.2.7	Yes
Application	mantisbt	mantisbt	1.2.8	Yes
Application	mantisbt	mantisbt	1.2.9	Yes
Application	mantisbt	mantisbt	1.2.10	Yes
Application	mantisbt	mantisbt	1.2.11	Yes
Application	mantisbt	mantisbt	1.2.12	Yes
Application	mantisbt	mantisbt	1.2.13	Yes
Application	mantisbt	mantisbt	1.2.14	Yes
Application	mantisbt	mantisbt	1.2.15	Yes
Application	mantisbt	mantisbt	1.2.16	Yes
Application	mantisbt	mantisbt	1.2.17	Yes

References

http://seclists.org/oss-sec/2014/q4/867 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/oss-sec/2014/q4/902 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/oss-sec/2014/q4/924 Mailing List, Third Party Advisory ([email protected])
http://secunia.com/advisories/62101 Third Party Advisory ([email protected])
http://www.debian.org/security/2015/dsa-3120 Third Party Advisory ([email protected])
https://github.com/mantisbt/mantisbt/commit/9fb8cf36f Patch, Third Party Advisory ([email protected])
https://www.mantisbt.org/bugs/view.php?id=17874 Exploit, Issue Tracking, Vendor Advisory ([email protected])
http://seclists.org/oss-sec/2014/q4/867 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/oss-sec/2014/q4/902 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/oss-sec/2014/q4/924 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/62101 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2015/dsa-3120 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/mantisbt/mantisbt/commit/9fb8cf36f Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mantisbt.org/bugs/view.php?id=17874 Exploit, Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)