Vulnerability Details CVE-2008-4689
Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 77.2%
CVSS Severity
CVSS v2 Score 7.5
References
- http://secunia.com/advisories/32975
- http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml
- http://www.mantisbt.org/bugs/changelog_page.php
- http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug
- http://www.mantisbt.org/bugs/view.php?id=9664
- http://www.openwall.com/lists/oss-security/2008/10/20/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46084
- http://secunia.com/advisories/32975
- http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml
- http://www.mantisbt.org/bugs/changelog_page.php
- http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug
- http://www.mantisbt.org/bugs/view.php?id=9664
- http://www.openwall.com/lists/oss-security/2008/10/20/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46084
Products affected by CVE-2008-4689
-
cpe:2.3:a:mantis:mantis:*
-
cpe:2.3:a:mantis:mantis:0.19.3
-
cpe:2.3:a:mantis:mantis:0.19.4
-
cpe:2.3:a:mantis:mantis:1.0.1
-
cpe:2.3:a:mantis:mantis:1.0.2
-
cpe:2.3:a:mantis:mantis:1.0.3
-
cpe:2.3:a:mantis:mantis:1.0.4
-
cpe:2.3:a:mantis:mantis:1.0.5
-
cpe:2.3:a:mantis:mantis:1.0.6
-
cpe:2.3:a:mantis:mantis:1.0.7
-
cpe:2.3:a:mantis:mantis:1.0.8
-
cpe:2.3:a:mantis:mantis:1.1.1