[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 04 Mar 2014 09:03:42 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability
On 28.02.2014 21:05, cve-assign@...re.org
wrote:
>> http://www.mantisbt.org/bugs/view.php?id=17055
>
>> admin_config_report.php relied on unsanitized, inlined query
>> parameters, enabling a malicious user to perform an SQL injection
>> attack.
>
> Use CVE-2014-2238.
>
MantisBT 1.2.17 has been released [1] and is available for download [2].
[1] http://www.mantisbt.org/blog/?p=288
[2] https://sourceforge.net/projects/mantisbt/files/mantis-stable/1.2.17/
---
This email is free from viruses and malware because avast! Antivirus protection is active.
http://www.avast.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
