CVE-2014-6387

Published: Oct 22, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind.

Affected (23)

Products: Mantisbt: Mantisbt

Mantisbt

1 product

Mantisbt

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Mantisbt Mantisbt	Up to 1.2.17
Mantisbt Mantisbt	Version 1.2.0
Mantisbt Mantisbt	Version 1.2.0 alpha1
Mantisbt Mantisbt	Version 1.2.0 alpha2
Mantisbt Mantisbt	Version 1.2.0 alpha3
Mantisbt Mantisbt	Version 1.2.0 rc1
Mantisbt Mantisbt	Version 1.2.0 rc2
Mantisbt Mantisbt	Version 1.2.10
Mantisbt Mantisbt	Version 1.2.11
Mantisbt Mantisbt	Version 1.2.12
Mantisbt Mantisbt	Version 1.2.13
Mantisbt Mantisbt	Version 1.2.14
Mantisbt Mantisbt	Version 1.2.15
Mantisbt Mantisbt	Version 1.2.16
Mantisbt Mantisbt	Version 1.2.1
Mantisbt Mantisbt	Version 1.2.2
Mantisbt Mantisbt	Version 1.2.3
Mantisbt Mantisbt	Version 1.2.4
Mantisbt Mantisbt	Version 1.2.5
Mantisbt Mantisbt	Version 1.2.6
Mantisbt Mantisbt	Version 1.2.7
Mantisbt Mantisbt	Version 1.2.8
Mantisbt Mantisbt	Version 1.2.9