Bug 1164620 (CVE-2014-8986) - CVE-2014-8986 mantis: cross-site scripting (XSS) issues to be fixed in the upcoming 1.2.18 release
Summary: CVE-2014-8986 mantis: cross-site scripting (XSS) issues to be fixed in the up...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2014-8986
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1164621 1164622
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-17 02:23 UTC by Murray McAllister
Modified: 2019-09-29 13:23 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:36:17 UTC
Embargoed:

Attachments (Terms of Use)

Description Murray McAllister 2014-11-17 02:23:31 UTC 
Two cross-site scripting (XSS) flaws are due to be fixed in the upcoming 1.2.18 release of MantisBT:

http://seclists.org/oss-sec/2014/q4/617
http://seclists.org/oss-sec/2014/q4/619

Upstream patches:
https://github.com/mantisbt/mantisbt/commit/cabacdc291c251bfde0dc2a2c945c02cef41bf40
https://github.com/mantisbt/mantisbt/commit/3d0625d84d5d08a998673713df1711e1d46b0b86
https://github.com/mantisbt/mantisbt/commit/49c3d089
Comment 1 Murray McAllister 2014-11-17 02:24:14 UTC 
Created mantis tracking bugs for this issue:

Affects: fedora-all [bug 1164621]
Comment 2 Murray McAllister 2014-11-17 02:25:08 UTC 
Created mantis tracking bugs for this issue:

Affects: epel-5 [bug 1164622]
Comment 3 Murray McAllister 2014-11-20 05:55:06 UTC 
MITRE assigned CVE-2014-8986 to this issue:

http://seclists.org/oss-sec/2014/q4/691
Comment 4 Fedora Update System 2014-12-20 08:34:51 UTC 
mantis-1.2.18-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-12-20 08:48:07 UTC 
mantis-1.2.18-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-12-20 08:51:43 UTC 
mantis-1.2.18-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 grangeway 2015-02-16 10:37:34 UTC 
Hello,

The patch for this issue was not included in 1.2.18.

Please see http://issue-track.org/security/CVE-2014-8986.html
Comment 9 Product Security DevOps Team 2019-06-08 02:36:17 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Note You need to log in before you can comment on or make changes to this bug.