CVE-2014-9759

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.92%

Published

Apr 11, 2016

Modified

May 6, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.

Weaknesses (CWE)

CWE-200

Affected Products (1)

mantisbt · mantisbtvulnerable

References (10)

http://sourceforge.net/p/mantisbt/mailman/message/32948048/

Patch

http://www.openwall.com/lists/oss-security/2016/01/02/1

http://www.openwall.com/lists/oss-security/2016/01/03/2

http://www.securitytracker.com/id/1035518

https://mantisbt.org/bugs/view.php?id=20277

Patch

http://sourceforge.net/p/mantisbt/mailman/message/32948048/

Patch

http://www.openwall.com/lists/oss-security/2016/01/02/1

http://www.openwall.com/lists/oss-security/2016/01/03/2

http://www.securitytracker.com/id/1035518

https://mantisbt.org/bugs/view.php?id=20277

Patch

KEV Catalog EPSS Scores Vendors All CVEs