CVE-2014-9269

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-01-09 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.

Affected products

Debian Linux: 7.0
mantisbt: 1.1.0-a1, 1.1.0-a2, 1.1.0-a3, 1.1.0-a4, 1.1.0-rc1, 1.1.0-rc2 (+35)

References

http://seclists.org/oss-sec/2014/q4/867
http://seclists.org/oss-sec/2014/q4/902
http://secunia.com/advisories/62101
http://www.debian.org/security/2015/dsa-3120
https://github.com/mantisbt/mantisbt/commit/511564cc
https://www.mantisbt.org/bugs/view.php?id=17890
http://seclists.org/oss-sec/2014/q4/867
http://seclists.org/oss-sec/2014/q4/902
http://secunia.com/advisories/62101
http://www.debian.org/security/2015/dsa-3120
https://github.com/mantisbt/mantisbt/commit/511564cc
https://www.mantisbt.org/bugs/view.php?id=17890

Get alerted when CVE-2014-9269 or the next vulnerability affects your stack