CVE-2017-12419
Vulnerability from cvelistv5
Published
2017-08-05 15:00
Modified
2024-08-05 18:36
Severity ?
Summary
If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL's "connect file read" feature to remotely access files on the MantisBT server.
References
cve@mitre.orghttp://openwall.com/lists/oss-security/2017/08/04/6Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/100142Third Party Advisory, VDB Entry
cve@mitre.orghttps://mantisbt.org/bugs/view.php?id=23173Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2017/08/04/6Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/100142Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://mantisbt.org/bugs/view.php?id=23173Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:36:56.181Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mantisbt.org/bugs/view.php?id=23173"
          },
          {
            "name": "100142",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100142"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2017/08/04/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-08-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the \u0027admin\u0027 directory (as recommended in the \"Post-installation and upgrade tasks\" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL\u0027s \"connect file read\" feature to remotely access files on the MantisBT server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-08T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mantisbt.org/bugs/view.php?id=23173"
        },
        {
          "name": "100142",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100142"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://openwall.com/lists/oss-security/2017/08/04/6"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-12419",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the \u0027admin\u0027 directory (as recommended in the \"Post-installation and upgrade tasks\" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL\u0027s \"connect file read\" feature to remotely access files on the MantisBT server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://mantisbt.org/bugs/view.php?id=23173",
              "refsource": "CONFIRM",
              "url": "https://mantisbt.org/bugs/view.php?id=23173"
            },
            {
              "name": "100142",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100142"
            },
            {
              "name": "http://openwall.com/lists/oss-security/2017/08/04/6",
              "refsource": "CONFIRM",
              "url": "http://openwall.com/lists/oss-security/2017/08/04/6"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-12419",
    "datePublished": "2017-08-05T15:00:00",
    "dateReserved": "2017-08-03T00:00:00",
    "dateUpdated": "2024-08-05T18:36:56.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-12419\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-08-05T15:29:00.177\",\"lastModified\":\"2024-11-21T03:09:26.493\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the \u0027admin\u0027 directory (as recommended in the \\\"Post-installation and upgrade tasks\\\" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL\u0027s \\\"connect file read\\\" feature to remotely access files on the MantisBT server.\"},{\"lang\":\"es\",\"value\":\"Si tras la correcta instalaci\u00f3n de MantisBT en su versi\u00f3n 2.5.2 en MySQL/MariaDB el administrador no elimina el directorio \\\"admin\\\" (tal y como se recomienda en la secci\u00f3n \\\"Post-installation and upgrade tasks\\\" de la MantisBT Admin Guide) y el cliente MySQL tiene una configuraci\u00f3n local_infile habilitada (en php.ini mysqli.allow_local_infile o el archivo de configuraci\u00f3n del cliente MySQL, dependiendo de la configuraci\u00f3n de PHP), un atacante podr\u00eda aprovecharse de la funcionalidad \\\"connect file read\\\" de MySQL para acceder de forma remota a los archivos del servidor de MantisBT.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mantisbt:mantisbt:2.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"146401B2-FDE4-4ACC-9CFA-E7BEE11D1FCF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2177DDD2-8830-4838-9945-0368DBDD1815\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA450156-3EEF-4F22-8F28-2E0A55C81FF6\"}]}]}],\"references\":[{\"url\":\"http://openwall.com/lists/oss-security/2017/08/04/6\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/100142\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://mantisbt.org/bugs/view.php?id=23173\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://openwall.com/lists/oss-security/2017/08/04/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/100142\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://mantisbt.org/bugs/view.php?id=23173\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.