Date: Sat, 08 Nov 2014 00:09:26 +0100 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: CVE-2014-8598: MantisBT XML Import/Export plugin unrestricted access Mitre assigned CVE-2014-8598 to this issue. Description: The XML Import/Export "official" plugin (i.e. bundled with MantisBT releases) currently does not perform any access level checks in the import and export pages. This leads to the following vulnerabilities: 1) import Any user of a MantisBT instance with the XML plugin enabled and knowing the URL to the plugin's import page could upload an XML file and insert data without restriction, regardless of their access level. This vulnerability is particularly dangerous when used in combination with the one described in issue #17725  (CVE-2014-7146) as it makes for a very simple and easily accessible vector for PHP code injection attacks. 2) export There was also no access check when exporting data, which could allow an attacker to gain access to confidential information (disclosure of all bug-related data, including usernames). Systems where the patch described below cannot be applied are strongly advised to uninstall the plugin. Affected versions: >= 1.2.0a3, <= 1.2.17 Fixed in versions: 1.2.18 (not yet released) Patch: See Github  Credit: Issue was discovered and fixed by Damien Regad (MantisBT Developer) References: Further details available in our issue tracker   http://www.mantisbt.org/bugs/view.php?id=17725  http://www.mantisbt.org/bugs/view.php?id=17780  https://github.com/mantisbt/mantisbt/commit/80a15487
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ