CVE-2014-9271

Published: Jan 9, 2015Modified: May 6, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.

Affected (40)

Products: Debian: Debian Linux · Mantisbt: Mantisbt

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration B

39 vulnerable

Vulnerable Software	Affected Versions
Mantisbt Mantisbt	Version 1.1.0 a1
Mantisbt Mantisbt	Version 1.1.0 a2
Mantisbt Mantisbt	Version 1.1.0 a3
Mantisbt Mantisbt	Version 1.1.0 a4
Mantisbt Mantisbt	Version 1.1.0 rc1
Mantisbt Mantisbt	Version 1.1.0 rc2
Mantisbt Mantisbt	Version 1.1.0 rc3
Mantisbt Mantisbt	Version 1.1.1
Mantisbt Mantisbt	Version 1.1.2
Mantisbt Mantisbt	Version 1.1.3
Mantisbt Mantisbt	Version 1.1.4
Mantisbt Mantisbt	Version 1.1.5
Mantisbt Mantisbt	Version 1.1.6
Mantisbt Mantisbt	Version 1.1.7
Mantisbt Mantisbt	Version 1.1.8
Mantisbt Mantisbt	Version 1.1.9
Mantisbt Mantisbt	Version 1.2.0
Mantisbt Mantisbt	Version 1.2.0 alpha1
Mantisbt Mantisbt	Version 1.2.0 alpha2
Mantisbt Mantisbt	Version 1.2.0 alpha3
Mantisbt Mantisbt	Version 1.2.0 rc1
Mantisbt Mantisbt	Version 1.2.0 rc2
Mantisbt Mantisbt	Version 1.2.10
Mantisbt Mantisbt	Version 1.2.11
Mantisbt Mantisbt	Version 1.2.12
Mantisbt Mantisbt	Version 1.2.13
Mantisbt Mantisbt	Version 1.2.14
Mantisbt Mantisbt	Version 1.2.15
Mantisbt Mantisbt	Version 1.2.16
Mantisbt Mantisbt	Version 1.2.17
Mantisbt Mantisbt	Version 1.2.1
Mantisbt Mantisbt	Version 1.2.2
Mantisbt Mantisbt	Version 1.2.3
Mantisbt Mantisbt	Version 1.2.4
Mantisbt Mantisbt	Version 1.2.5
Mantisbt Mantisbt	Version 1.2.6
Mantisbt Mantisbt	Version 1.2.7
Mantisbt Mantisbt	Version 1.2.8
Mantisbt Mantisbt	Version 1.2.9