CVE-2014-9759: Mantisbt

Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.

Affected products

• Mantisbt Mantisbt: version 1.3.0 only

Published 2016-04-11. Last modified 2026-06-17.