CVE-2014-9271 — MEDIUM (5.4)

Vulnerability Description

Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Debian	Debian Linux	7.0
Mantisbt	Mantisbt	1.1.0

Related Weaknesses (CWE)

CWE-79

References

http://seclists.org/oss-sec/2014/q4/867Mailing ListThird Party Advisory
http://seclists.org/oss-sec/2014/q4/902Mailing ListThird Party Advisory
http://seclists.org/oss-sec/2014/q4/924Mailing ListThird Party Advisory
http://secunia.com/advisories/62101Third Party Advisory
http://www.debian.org/security/2015/dsa-3120Third Party Advisory
https://github.com/mantisbt/mantisbt/commit/9fb8cf36fPatchThird Party Advisory
https://www.mantisbt.org/bugs/view.php?id=17874ExploitIssue TrackingVendor Advisory
http://seclists.org/oss-sec/2014/q4/867Mailing ListThird Party Advisory
http://seclists.org/oss-sec/2014/q4/902Mailing ListThird Party Advisory
http://seclists.org/oss-sec/2014/q4/924Mailing ListThird Party Advisory
http://secunia.com/advisories/62101Third Party Advisory
http://www.debian.org/security/2015/dsa-3120Third Party Advisory
https://github.com/mantisbt/mantisbt/commit/9fb8cf36fPatchThird Party Advisory
https://www.mantisbt.org/bugs/view.php?id=17874ExploitIssue TrackingVendor Advisory

FAQ

What is CVE-2014-9271?

CVE-2014-9271 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extensio...

How severe is CVE-2014-9271?

CVE-2014-9271 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-9271?

Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Mantisbt Mantisbt.