CVE-2008-3102

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-24 · updated 2026-06-16
Weakness: CWE-310

Description

Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected products

mantisbt: 1.1.0, 1.1.1, 1.1.2, 1.2.0a1, 1.2.0a2

References

http://int21.de/cve/CVE-2008-3102-mantis.html
http://secunia.com/advisories/32243
http://secunia.com/advisories/32330
http://secunia.com/advisories/32975
http://securityreason.com/securityalert/4298
http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml
http://www.securityfocus.com/archive/1/496625/100/0/threaded
http://www.securityfocus.com/archive/1/496684/100/0/threaded
http://www.securityfocus.com/bid/31344
https://exchange.xforce.ibmcloud.com/vulnerabilities/45395
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00504.html
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00648.html

Get alerted when CVE-2008-3102 or the next vulnerability affects your stack