CVE

Id
76289  
CVE No.
CVE-2014-8988  
Status
Candidate  
Description
MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.  
Phase
Assigned (20141119)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
703217 76289 CVE-2014-8988 MLIST:[oss-security] 20141115 CVE Request: information disclosure in MantisBT attachments  View
703218 76289 CVE-2014-8988 URL:http://www.openwall.com/lists/oss-security/2014/11/15/6  View
703219 76289 CVE-2014-8988 MLIST:[oss-security] 20141119 Re: CVE Request: information disclosure in MantisBT attachments  View
703220 76289 CVE-2014-8988 URL:http://seclists.org/oss-sec/2014/q4/693  View
703221 76289 CVE-2014-8988 CONFIRM:http://www.mantisbt.org/bugs/view.php?id=17742  View
703222 76289 CVE-2014-8988 CONFIRM:https://github.com/mantisbt/mantisbt/commit/5f0b150b  View
703223 76289 CVE-2014-8988 DEBIAN:DSA-3120  View
703224 76289 CVE-2014-8988 URL:http://www.debian.org/security/2015/dsa-3120  View
703225 76289 CVE-2014-8988 BID:71104  View
703226 76289 CVE-2014-8988 URL:http://www.securityfocus.com/bid/71104  View
703227 76289 CVE-2014-8988 SECUNIA:62101  View
703228 76289 CVE-2014-8988 URL:http://secunia.com/advisories/62101  View
703229 76289 CVE-2014-8988 XF:mantisbt-fileapi-sec-bypass(98731)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16690 JVNDB-2014-005565 Nibbleblog におけるクロスサイトスクリプティングの脆弱性 Nibbleblog には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2014-8996 76289 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005565.html  View