CVE-2014-6316: core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web...

Security readout for executives and security teams

MantisBT before 1.2.18 could be abused to redirect users from its login page to an attacker-controlled site. This does not indicate server compromise by itself, but it can make phishing links look more trustworthy because they begin on a legitimate MantisBT domain. Exposure is most likely for internet-facing MantisBT deployments older than 1.2.18 where login_page.php is reachable. Internal-only instances still carry phishing risk for staff. The supplied CVE record has incomplete affected-product metadata, so validate against deployed MantisBT versions. Treat this as a phishing-enablement issue rather than a system takeover flaw. Prioritize patching internet-facing or customer-visible MantisBT instances, especially where users trust the domain for authentication or issue tracking. Mitigation focus: Upgrade MantisBT to 1.2.18 or later where applicable.; Apply vendor or distribution backports, including Debian guidance if using packaged MantisBT.; Check vendor advisories for supported fixes before changing production systems..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.