high7.5
CVE-2008-4689
Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
Impact
Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mantis | Mantis | through 1.1.2 Versions 0.19.3, 0.19.4, 1.0.1, 1.0.2, 1.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/32975
- http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml
- http://www.mantisbt.org/bugs/changelog_page.php
- http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug
- http://www.mantisbt.org/bugs/view.php?id=9664
- http://www.openwall.com/lists/oss-security/2008/10/20/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46084
- http://secunia.com/advisories/32975
- http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml
- http://www.mantisbt.org/bugs/changelog_page.php
- http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug
- http://www.mantisbt.org/bugs/view.php?id=9664
- http://www.openwall.com/lists/oss-security/2008/10/20/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46084