{"id":"CVE-2019-15715","details":"MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.","aliases":["GHSA-v23g-wjvq-2fpf"],"modified":"2026-08-07T14:52:39.521821Z","published":"2019-10-09T20:15:23.207Z","references":[{"type":"ADVISORY","url":"https://mantisbt.org/bugs/changelog_page.php?project=mantisbt"},{"type":"REPORT","url":"https://mantisbt.org/bugs/view.php?id=26091"},{"type":"REPORT","url":"https://mantisbt.org/bugs/view.php?id=26162"},{"type":"FIX","url":"https://github.com/mantisbt/mantisbt/commit/5fb979604d88c630343b3eaf2b435cd41918c501"},{"type":"FIX","url":"https://github.com/mantisbt/mantisbt/commit/7092573fac31eff41823f13540324db167c8bd52"},{"type":"FIX","url":"https://github.com/mantisbt/mantisbt/commit/cebfb9acb3686e8904d80bd4bc80720b54ba08e5"},{"type":"FIX","url":"https://github.com/mantisbt/mantisbt/commit/fc7668c8e45db55fc3a4b991ea99d2b80861a14c"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mantisbt/mantisbt","events":[{"introduced":"fdb93a72d8a2ae7ea3b66bd3eb5080fc5fb641f1"},{"fixed":"1f6fd21a01f41212618f3d33b64cdd3c51d1179c"},{"introduced":"ac51f2a22377ec1cef40ae53048327d7ab2df33e"},{"fixed":"cf7df5afd61ab40ecd5b21d901e9b790f972afb3"},{"fixed":"5fb979604d88c630343b3eaf2b435cd41918c501"},{"fixed":"7092573fac31eff41823f13540324db167c8bd52"},{"fixed":"cebfb9acb3686e8904d80bd4bc80720b54ba08e5"},{"fixed":"fc7668c8e45db55fc3a4b991ea99d2b80861a14c"}],"database_specific":{"cpe":"cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.3.20"},{"introduced":"2.0.0"},{"fixed":"2.22.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["release-2.22.0","release-2.21.0","release-2.20.0","release-2.19.0","release-2.18.0","release-2.17.0","release-2.16.0","release-2.15.0","release-2.14.0","release-2.13.0","release-2.12.0","release-2.11.0","release-2.10.0","release-2.9.0","release-2.8.0","release-2.7.0","release-2.6.0","release-2.5.0","release-2.4.0","release-2.3.0","release-2.2.0","release-2.1.0","release-2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15715.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}