Unscored severity · published Nov 18, 2014
CVE-2014-8598
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain…
–
CVSS
38.5%
EPSS
No
On KEV
Description
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
Exploitation
Is it being used?
Exploit prediction (EPSS)38.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mantisbt · Mantisbt
through 1.2.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8598
secunia.com
http://secunia.com/advisories/62101
www.debian.org
http://www.debian.org/security/2015/dsa-3120
Vendor Advisory
http://www.mantisbt.org/bugs/view.php?id=17780
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/11/07/28
www.securityfocus.com
http://www.securityfocus.com/bid/70996
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/98573
More from Mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php