MantisBT version 1.2.18 (and older versions) are affected by multiple security issues. All installations that are currently running any 1.2.x version are strongly advised to upgrade to MantisBT 1.2.19.
This release resolves 5 security issues:
- #17938/CVE-2014-9571: XSS in install.php
- #17939/CVE-2014-9572: Improper Access Control in install.php
- #17940/CVE-2014-9573: SQL Injection in manage_user_page.php
- #17984/CVE-2014-9624: CAPTCHA bypass
- #17997/CVE-2015-1042: URL redirection issue
- Upgrade to the latest version of MantisBT (these issues were fixed in version 1.2.19).
CVE-2014-9571 CVE-2014-9572 CVE-2014-9573 CVE-2014-9624 CVE-2015-1042
- WordPress Plugin MAC PHOTO GALLERY Arbitrary File Download (3.0)
- WordPress Plugin YAWPP (Yet Another WordPress Petition Plugin) SQL Injection (1.2)
- WordPress Plugin Better WordPress Minify Arbitrary File Disclosure (1.2.2)
- WordPress Plugin U Extended Comment 'fileurl' Parameter Arbitrary File Download (1.0.1)
- WordPress Plugin WP Statistics SQL Injection (9.4)