Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2014-7146
HistoryNov 18, 2014 - 3:59 p.m.

CVE-2014-7146

2014-11-1815:59:02
CWE-20
[email protected]
web.nvd.nist.gov
4

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6

Confidence

High

EPSS

0.353

Percentile

97.2%

JSON

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.

Affected configurations

Nvd
Node
mantisbtmantisbtMatch1.2.17
VendorProductVersionCPE
mantisbtmantisbt1.2.17cpe:2.3:a:mantisbt:mantisbt:1.2.17:*:*:*:*:*:*:*

Related

zdt 4
cve 2
prion 2
packetstorm 2
cvelist 2
ubuntucve 2
securityvulns 3
exploitdb 2
metasploit 1
nvd 1
archlinux 1
fedora 9
nessus 6
openvas 11
debian 1
osv 1
zdt
zdt
MantisBT XmlImportExport Plugin PHP Code Injection Exploit
2014-11-16 00:00:00
MantisBT XmlImportExport Plugin PHP Code Injection Exploit
2014-11-18 00:00:00
Mantis Bug Tracker 1.2.17 PHP Code Injection Vulnerability
2015-01-01 00:00:00
cve
cve
CVE-2014-7146
2014-11-18 15:59:02
CVE-2014-8598
2014-11-18 15:59:06
prion
prion
Code injection
2014-11-18 15:59:00
Code injection
2014-11-18 15:59:00
packetstorm
packetstorm
Mantis Bug Tracker 1.2.17 PHP Code Injection
2014-12-31 00:00:00
MantisBT XmlImportExport Plugin PHP Code Injection
2014-11-18 00:00:00
cvelist
cvelist
CVE-2014-7146
2014-11-18 15:00:00
CVE-2014-8598
2014-11-18 15:00:00
ubuntucve
ubuntucve
CVE-2014-7146
2014-11-18 00:00:00
CVE-2014-8598
2014-11-18 00:00:00
securityvulns
securityvulns
[KIS-2014-18] Mantis Bug Tracker <= 1.2.17 (ImportXml.php) PHP Code Injection Vulnerability
2015-01-02 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2015-01-02 00:00:00
[SECURITY] [DSA 3120-1] mantis security update
2015-01-19 00:00:00
exploitdb
exploitdb
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (2)
2014-11-18 00:00:00
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (1)
2014-11-18 00:00:00
metasploit
metasploit
MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability
2014-11-09 13:00:44
nvd
nvd
CVE-2014-8598
2014-11-18 15:59:06
archlinux
archlinux
mantisbt: arbitrary code execution and unrestricted access
2014-11-12 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: mantis-1.2.17-4.fc21
2014-12-12 04:21:50
[SECURITY] Fedora 20 Update: mantis-1.2.17-4.fc20
2014-12-12 04:30:46
[SECURITY] Fedora 21 Update: mantis-1.2.19-1.fc21
2015-02-07 04:03:22
nessus
nessus
Fedora 19 : mantis-1.2.17-4.fc19 (2014-15079)
2014-12-15 00:00:00
Fedora 20 : mantis-1.2.17-4.fc20 (2014-15108)
2014-12-15 00:00:00
Fedora 21 : mantis-1.2.17-4.fc21 (2014-15142)
2014-12-15 00:00:00
openvas
openvas
Fedora Update for mantis FEDORA-2014-15142
2015-01-05 00:00:00
Fedora Update for mantis FEDORA-2014-15108
2014-12-12 00:00:00
Fedora Update for mantis FEDORA-2015-1419
2015-02-07 00:00:00
debian
debian
[SECURITY] [DSA 3120-1] mantis security update
2015-01-06 20:35:26
osv
osv
mantis - security update
2015-01-06 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6

Confidence

High

EPSS

0.353

Percentile

97.2%

JSON
Related for NVD:CVE-2014-7146
zdt4cve2prion2packetstorm2cvelist2ubuntucve2securityvulns3exploitdb2metasploit1nvd1archlinux1fedora9nessus6openvas11debian1osv1