PT-2008-5901 · Mantis · Mantis

Christian Hoffmann · Published 2008-10-22 · Updated 2017-08-08 · CVE-2008-4689

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mantis versions prior to 1.1.3

Description The issue makes it easier for remote attackers to hijack sessions because the session cookie is not unset during logout.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-4689

Affected Products

Mantis

References · 8

• http://gentoo.org/security/en/glsa/glsa-200812-07.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4689 · Security Note
• http://openwall.com/lists/oss-security/2008/10/20/1 · Note
• http://mantisbt.org/bugs/view.php?id=9664 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46084 · Note
• http://mantisbt.org/bugs/changelog_page.php · Note
• http://secunia.com/advisories/32975 · Note
• http://mantisbt.org/bugs/file_download.php?file_id=1988&type=bug · Note