Post Authentication Command Injection in MantisBT by Mantis Bug Tracker
CVE-2019-15715

7.2HIGH

Key Information:

Vendor

Mantisbt

Status
Mantisbt
Vendor
CVE Published:
9 October 2019

What is CVE-2019-15715?

An issue has been identified in MantisBT that allows attackers to exploit post-authentication command injection vulnerabilities, which may lead to remote code execution. This flaw affects MantisBT versions prior to 1.3.20 and 2.22.1. Successful exploitation can allow an attacker to execute arbitrary commands on the server, posing a severe risk to system integrity and data confidentiality. It is crucial for users to upgrade to the latest versions to mitigate this risk.

References

https://mantisbt.org/bugs/changelog_page.php?project=mant...
x_refsource_MISC
https://mantisbt.org/bugs/view.php?id=26091
x_refsource_CONFIRM
https://github.com/mantisbt/mantisbt/commit/fc7668c8e45db...
x_refsource_CONFIRM

EPSS Score

22% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.