CVE-2014-9117: MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows r...

Security readout for executives and security teams

MantisBT versions before 1.2.18 had a CAPTCHA design flaw that could let a remote user bypass CAPTCHA checks. This does not indicate system takeover by itself, but it can weaken anti-abuse controls on exposed bug trackers, enabling automated submissions or account-related abuse where CAPTCHA was relied on. Exposure is most likely on internet-facing MantisBT installations older than 1.2.18, especially public workflows protected primarily by CAPTCHA. The source bundle does not identify affected CPEs or detailed deployment conditions. Treat as a moderate maintenance and abuse-prevention issue. Prioritize exposed public MantisBT systems, especially where anonymous submissions or registrations matter to operations, but do not handle as a confirmed actively exploited emergency based on these sources. Mitigation focus: Upgrade MantisBT to 1.2.18 or later.; Apply fixed vendor or distribution packages, including Debian advisories where relevant.; Review upstream MantisBT guidance for supported versions and backports..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.