CVE-2008-4689: High severity mentiss acgv acgvannu vulnerability
Published Oct 22, 2008
·Updated
Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
Affected Software
12 affected components
Mantis Mantis<=1.1.2
Mantis Mantis=0.19.3
Mantis Mantis=0.19.4
Mantis Mantis=1.0.1
Mantis Mantis=1.0.2
Mantis Mantis=1.0.3
Mantis Mantis=1.0.4
Mantis Mantis=1.0.5
Mantis Mantis=1.0.6
Mantis Mantis=1.0.7
Mantis Mantis=1.0.8
Mantis Mantis=1.1.1
Event History
Oct 22, 2008
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-4689?
CVE-2008-4689 has a medium severity level, as it allows session hijacking without proper session cookie management during logout.
2
How do I fix CVE-2008-4689?
To fix CVE-2008-4689, upgrade Mantis to version 1.1.3 or later, which addresses the session cookie issue.
3
Which versions are affected by CVE-2008-4689?
CVE-2008-4689 affects Mantis versions up to and including 1.1.2, alongside multiple earlier versions such as 1.0.1 to 1.0.8.
4
What kind of attack is possible with CVE-2008-4689?
CVE-2008-4689 allows for session hijacking, enabling attackers to gain unauthorized access to active user sessions.
5
Is it safe to use Mantis versions before 1.1.3 after CVE-2008-4689?
It is not safe to use any version of Mantis before 1.1.3 due to the vulnerability described in CVE-2008-4689.