CVE-2014-2238

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-03-05 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.

Affected products

mantisbt: 1.2.13, 1.2.14, 1.2.15, 1.2.16

References

http://mantisbt.domainunion.de/bugs/view.php?id=17055
http://seclists.org/oss-sec/2014/q1/456
http://seclists.org/oss-sec/2014/q1/490
http://www.mantisbt.org/blog/?p=288
http://www.securityfocus.com/bid/65903
https://exchange.xforce.ibmcloud.com/vulnerabilities/91563
http://mantisbt.domainunion.de/bugs/view.php?id=17055
http://seclists.org/oss-sec/2014/q1/456
http://seclists.org/oss-sec/2014/q1/490
http://www.mantisbt.org/blog/?p=288
http://www.securityfocus.com/bid/65903
https://exchange.xforce.ibmcloud.com/vulnerabilities/91563

Get alerted when CVE-2014-2238 or the next vulnerability affects your stack