Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2008-09-24 11:42
Updated : 2024-02-28 11:21
NVD link : CVE-2008-3102
Mitre link : CVE-2008-3102
CVE.ORG link : CVE-2008-3102
JSON object : View
Products Affected
mantisbt
- mantisbt
CWE
CWE-310
Cryptographic Issues