CVE-2014-8598

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 38.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-18 · updated 2026-06-17
Weakness: CWE-19

Description

The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.

Affected products

mantisbt: through 1.2.17

References

http://secunia.com/advisories/62101
http://www.debian.org/security/2015/dsa-3120
http://www.mantisbt.org/bugs/view.php?id=17780
http://www.openwall.com/lists/oss-security/2014/11/07/28
http://www.securityfocus.com/bid/70996
https://exchange.xforce.ibmcloud.com/vulnerabilities/98573
https://github.com/mantisbt/mantisbt/commit/80a15487
http://secunia.com/advisories/62101
http://www.debian.org/security/2015/dsa-3120
http://www.mantisbt.org/bugs/view.php?id=17780
http://www.openwall.com/lists/oss-security/2014/11/07/28
http://www.securityfocus.com/bid/70996

Get alerted when CVE-2014-8598 or the next vulnerability affects your stack