CVE-2008-4689 Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mantis | <= 1.1.2 | No fix listed |
| mantis | = 0.19.3 | No fix listed |
| mantis | = 0.19.4 | No fix listed |
| mantis | = 1.0.1 | No fix listed |
| mantis | = 1.0.2 | No fix listed |
| mantis | = 1.0.3 | No fix listed |
| mantis | = 1.0.4 | No fix listed |
| mantis | = 1.0.5 | No fix listed |
| mantis | = 1.0.6 | No fix listed |
| mantis | = 1.0.7 | No fix listed |
| mantis | = 1.0.8 | No fix listed |
| mantis | = 1.1.1 | No fix listed |
References
- 32975 third-party-advisory
- GLSA-200812-07 vendor-advisory
- www.mantisbt.org
- www.mantisbt.org
- www.mantisbt.org
- [oss-security] 20081020 Re: CVE request: mantisbt < 1.1.4: RCE mailing-list
- mantis-session-cookie-hijacking(46084) vdb-entry