CVE-2019-15715: MantisBT Remote Code Execution Vulnerability
Summary
CVE-2019-15715: MantisBT Remote Code Execution. Affects mantisbt/mantisbt across 2 version ranges.
< 1.3.20
>= 2.0.0, < 2.22.1
Fixed in 1.3.20 or 2.22.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MantisBT is an open-source issue tracker that provides a user-friendly interface for managing software development projects. It offers features such as bug tracking, project management, and collaboration tools. However, certain versions of MantisBT are vulnerable to a remote code execution flaw due to improper handling of user input, which can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2019-15715 affects MantisBT versions prior to 1.3.20 and 2.22.1. It allows authenticated users to execute arbitrary commands on the server through post-authentication command injection. This flaw arises from inadequate sanitization of user inputs, enabling attackers to manipulate commands that the server executes, potentially leading to unauthorized access and control over the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.201.3.20composer require mantisbt/mantisbt:1.3.20 -
>= 2.0.0, < 2.22.12.22.1composer require mantisbt/mantisbt:2.22.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround involves restricting access to the application for non-administrative users, thereby minimizing the risk of exploitation until the patch can be applied.
Conclusion
CVE-2019-15715 is a significant vulnerability in MantisBT that can lead to remote code execution if not addressed. Users are strongly encouraged to update to the latest versions to protect their systems. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
CVE-2019-15715 is a vulnerability in MantisBT that allows remote code execution through post-authentication command injection.
Versions of MantisBT prior to 1.3.20 and 2.22.1 are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2019-15715 is 7.2, indicating a high severity level.
If immediate upgrading is not possible, restrict access to the application for non-administrative users as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
