ID CVE-2008-3102
Summary Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
References
Vulnerable Configurations
  • cpe:2.3:a:mantisbt:mantisbt:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:mantisbt:mantisbt:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mantisbt:mantisbt:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:mantisbt:mantisbt:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mantisbt:mantisbt:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:mantisbt:mantisbt:1.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mantisbt:mantisbt:1.2.0a1:*:*:*:*:*:*:*
    cpe:2.3:a:mantisbt:mantisbt:1.2.0a1:*:*:*:*:*:*:*
  • cpe:2.3:a:mantisbt:mantisbt:1.2.0a2:*:*:*:*:*:*:*
    cpe:2.3:a:mantisbt:mantisbt:1.2.0a2:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-10-2018 - 20:45)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
bid 31344
bugtraq
  • 20080922 menalto gallery: Session hijacking vulnerability, CVE-2008-3102
  • 20080923 mantis CVE-2008-3102 (Re: menalto gallery: Session hijacking vulnerability, CVE-2008-3102)
fedora
  • FEDORA-2008-8925
  • FEDORA-2008-9015
gentoo GLSA-200812-07
misc http://int21.de/cve/CVE-2008-3102-mantis.html
secunia
  • 32243
  • 32330
  • 32975
sreason 4298
xf mantis-cookie-session-hijacking(45395)
Last major update 11-10-2018 - 20:45
Published 24-09-2008 - 11:42
Last modified 11-10-2018 - 20:45
Back to Top