CVE-2014-8554

2014-11-1300:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.2%

JSON

SQL injection vulnerability in the mc_project_get_attachments function in
api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote
attackers to execute arbitrary SQL commands via the project_id parameter.
NOTE: this vulnerability exists because of an incomplete fix for
CVE-2014-1609.