CVE-2017-12419

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-12419

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12419.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-12419

Published

2017-08-05T15:29:00.177Z

Modified

2026-08-04T11:47:34.765671520Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a localinfile setting enabled (in php.ini mysqli.allowlocal_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL's "connect file read" feature to remotely access files on the MantisBT server.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:mantisbt:mantisbt:2.5.2:*:*:*:*:*:*:*"
            ],
            "vendor_product": "mantisbt:mantisbt",
            "extracted_events": [
                {
                    "introduced": "2.5.2"
                },
                {
                    "last_affected": "2.5.2"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-nodejs

Affected ranges

Type

GIT

Repo

https://github.com/mariadb-corporation/mariadb-connector-nodejs

Events

Introduced

Fixed

36373d52d5ec5673d8545f06a05556b23925f3fc

Database specific

{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.2"
        }
    ]
}

Affected versions

0.*

0.7.0

2.*

2.0.3

2.0.5

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.2.0

2.3.0

2.4.0

2.4.1

2.4.2

2.5.0

2.5.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12419.json"