CVE-2014-9571

Name	CVE-2014-9571
Description	Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	780875

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mantis	source	squeeze	(unfixed)	end-of-life
mantis	source	(unstable)	(unfixed)			780875

Notes

[wheezy] - mantis <no-dsa> (Minor issue)
[squeeze] - mantis <end-of-life> (Unsupported in squeeze-lts)
Upstream patch: http://github.com/mantisbt/mantisbt/commit/6d47c047 (1.2.x)
https://www.mantisbt.org/bugs/view.php?id=17938