Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 00:48
Type | Values Removed | Values Added |
---|---|---|
References | () http://int21.de/cve/CVE-2008-3102-mantis.html - | |
References | () http://secunia.com/advisories/32243 - Vendor Advisory | |
References | () http://secunia.com/advisories/32330 - Vendor Advisory | |
References | () http://secunia.com/advisories/32975 - Vendor Advisory | |
References | () http://securityreason.com/securityalert/4298 - | |
References | () http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml - | |
References | () http://www.securityfocus.com/archive/1/496625/100/0/threaded - | |
References | () http://www.securityfocus.com/archive/1/496684/100/0/threaded - | |
References | () http://www.securityfocus.com/bid/31344 - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/45395 - | |
References | () https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00504.html - | |
References | () https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00648.html - |
Information
Published : 2008-09-24 11:42
Updated : 2024-11-21 00:48
NVD link : CVE-2008-3102
Mitre link : CVE-2008-3102
CVE.ORG link : CVE-2008-3102
JSON object : View
Products Affected
mantisbt
- mantisbt
CWE
CWE-310
Cryptographic Issues