CVE-2014-8598

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.x

Description The XML Import/Export plugin does not restrict access, allowing remote attackers to upload arbitrary XML files via the import page or obtain sensitive information via the export page.

Recommendations For MantisBT versions 1.2.x, restrict access to the XML Import/Export plugin to prevent unauthorized uploads and sensitive information disclosure. As a temporary workaround, consider disabling the XML Import/Export plugin until a patch is available.