Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 29 Nov 2014 18:16:01 +0100
From: Damien Regad <>
Subject: CVE Request: DB credentials disclosure in MantisBT's unattended upgrade


Kindly assign a CVE ID for the following issue.


The unattended upgrade script retrieved DB connection settings from POST 
parameters, allowing an attacker to get the script to connect to their 
host with the current DB config credentials.

As per installation instructions [1], the admin/ directory (which 
contains the vulnerable script) should be deleted in a Production instance.

Affected versions:
 >= 1.1.0a3, <= 1.2.17

Fixed in versions:
1.2.18 (not yet released)

See Github [2]

Issue was reported by Mathias Karlsson ( as 
part of Offensive Security's bug bounty program [3].
It was fixed by Paul Richards.

Further details available in our issue tracker [4]


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.