Unscored CVE-2014-9572 EUVD-2014-9386GHSA-fgr7-5vq4-23hv

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to …

Published Jan 26, 2015 · Updated Aug 6, 2024 · Assigned by mitre

Description

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

References

1031633 vdb-entry
[oss-security] 20150117 CVE-2014-9572: Improper Access Control in install.php mailing-list
mantisbt-cve20149572-sec-bypass(100211) vdb-entry
https://www.htbridge.com/advisory/HTB23243
https://www.mantisbt.org/bugs/view.php?id=17939
https://www.mantisbt.org/bugs/view.php?id=17937