CVEvulnerability
CVE-2008-3102
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-09-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Affected configurations
• mantisbt mantisbt 1.1.0
• mantisbt mantisbt 1.1.1
• mantisbt mantisbt 1.1.2
• mantisbt mantisbt 1.2.0a1
• mantisbt mantisbt 1.2.0a2
Related
Weakness · not in database (1)
References
- http://int21.de/cve/CVE-2008-3102-mantis.html int21.de
- http://secunia.com/advisories/32243 Vendor Advisory
- http://secunia.com/advisories/32330 Vendor Advisory
- http://secunia.com/advisories/32975 Vendor Advisory
- http://securityreason.com/securityalert/4298 securityreason.com
- http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml www.gentoo.org
- http://www.securityfocus.com/archive/1/496625/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/496684/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31344 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45395 exchange.xforce.ibmcloud.com
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00504.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00648.html www.redhat.com
- http://int21.de/cve/CVE-2008-3102-mantis.html int21.de
- http://secunia.com/advisories/32243 Vendor Advisory
- http://secunia.com/advisories/32330 Vendor Advisory
- http://secunia.com/advisories/32975 Vendor Advisory
- http://securityreason.com/securityalert/4298 securityreason.com
- http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml www.gentoo.org
- http://www.securityfocus.com/archive/1/496625/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/496684/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31344 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45395 exchange.xforce.ibmcloud.com
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00504.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00648.html www.redhat.com