CVE-2014-9117

MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection…

published December 6, 2014

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02343 · 83.4th percentile
Published
2014-12-06T21:00Z
EPSS history
Timeline
  • 06 DEC 21:00Z
    MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection…
    cvelistv5