CVE-2008-3102: Medium severity centos libreport-plugin-mantisbt vulnerability

Published Sep 24, 2008

Updated

Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected Software

5 affected components

MantisBT mantisbt=1.2.0a1

MantisBT mantisbt=1.2.0a2

MantisBT mantisbt=1.1.0

MantisBT mantisbt=1.1.2

MantisBT mantisbt=1.1.1

Event History

Sep 24, 2008

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3102?

CVE-2008-3102 is classified as a medium severity vulnerability due to potential exposure of session cookies.

How do I fix CVE-2008-3102?

To fix CVE-2008-3102, ensure that the secure flag is set for session cookies in Mantis versions affected by this vulnerability.

Which versions of Mantis are affected by CVE-2008-3102?

CVE-2008-3102 affects MantisBT versions 1.1.0 through 1.1.2 and 1.2.0a2.

What are the risks associated with CVE-2008-3102?

The risks associated with CVE-2008-3102 include the potential for remote attackers to capture session cookies, leading to session hijacking.

Can CVE-2008-3102 affect both http and https sessions?

Yes, CVE-2008-3102 can affect both http and https sessions because cookies may be sent over insecure connections.