CVEvulnerability
CVE-2009-20001
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-03-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-613
Description
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
Affected configurations
• mantisbt mantisbt (< 2.24.5)
Related
Weakness · not in database (1)
References
- https://mantisbt.org/bugs/view.php?id=11296 Issue Tracking, Vendor Advisory
- https://mantisbt.org/bugs/view.php?id=27976 Exploit, Issue Tracking, Vendor Advisory
- https://mantisbt.org/bugs/view.php?id=11296 Issue Tracking, Vendor Advisory
- https://mantisbt.org/bugs/view.php?id=27976 Exploit, Issue Tracking, Vendor Advisory