| Vulnerability Name: | CVE-2008-3102 (CCN-45395) | ||||||||
| Assigned: | 2008-09-23 | ||||||||
| Published: | 2008-09-23 | ||||||||
| Updated: | 2018-10-11 | ||||||||
| Summary: | Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-310 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2008-3102 Source: CCN Type: Hanno Boeck Advisories, 2008-09-23 Mantis: Session hijacking vulnerability, CVE-2008-3102 Source: MISC Type: UNKNOWN http://int21.de/cve/CVE-2008-3102-mantis.html Source: CCN Type: SA32243 Mantis Referenced Reports Information Disclosure Security Issue Source: SECUNIA Type: Vendor Advisory 32243 Source: SECUNIA Type: Vendor Advisory 32330 Source: SECUNIA Type: Vendor Advisory 32975 Source: SREASON Type: UNKNOWN 4298 Source: CCN Type: GLSA-200812-07 Mantis: Multiple vulnerabilities Source: GENTOO Type: UNKNOWN GLSA-200812-07 Source: CCN Type: Mantis Web site Mantis Bug Tracker Source: CCN Type: mantisbt - Change Log mantisbt - 1.1.3 (released 2008-10-14) Source: CCN Type: OSVDB ID: 49071 Mantis HTTPS Session Cookie Secure Flag Weakness Source: CCN Type: OSVDB ID: 49072 Mantis Referenced Report Link Tag Title/Status Disclosure Source: BUGTRAQ Type: UNKNOWN 20080922 menalto gallery: Session hijacking vulnerability, CVE-2008-3102 Source: BUGTRAQ Type: UNKNOWN 20080923 mantis CVE-2008-3102 (Re: menalto gallery: Session hijacking vulnerability, CVE-2008-3102) Source: BID Type: UNKNOWN 31344 Source: CCN Type: BID-31344 Mantis Insecure Cookie Disclosure Weakness Source: XF Type: UNKNOWN mantis-cookie-session-hijacking(45395) Source: XF Type: UNKNOWN mantis-cookie-session-hijacking(45395) Source: FEDORA Type: UNKNOWN FEDORA-2008-8925 Source: FEDORA Type: UNKNOWN FEDORA-2008-9015 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||