Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

The remote host is affected by the vulnerability described in GLSA-200812-07 (Mantis: Multiple vulnerabilities)

    Multiple issues have been reported in Mantis:
    EgiX reported that manage_proj_page.php does not correctly sanitize the     sort parameter before passing it to create_function() in     core/utility_api.php (CVE-2008-4687).
    Privileges of viewers are not sufficiently checked before composing a     link with issue data in the source anchor (CVE-2008-4688).
    Mantis does not unset the session cookie during logout (CVE-2008-4689).
    Mantis does not set the secure flag for the session cookie in an HTTPS     session (CVE-2008-3102).
  Impact :

    Remote unauthenticated attackers could exploit these vulnerabilities to     execute arbitrary PHP commands, disclose sensitive issue data, or     hijack a user's sessions.
  Workaround :

    There is no known workaround at this time.

The mantis Team reports :

When configuring a web application to use only ssl (e. g. by forwarding all http-requests to https), a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Else the cookie will be transferred through http if the victim's browser does a single http-request on the same domain.

The remote server is running Mantis, a bug-tracking software.  This version of Mantis is vulnerable to a flaw where cookies passed over SSL are not marked as 'Secure'.  Given this, the cookie can be requested over HTTP and sent via plaintext.

This releases fixes CVE-2008-3102 and a bunch of other issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This releases fixes CVE-2008-3102 and a bunch of other issues. For the full changelog, please check:
http://www.mantisbt.org/bugs/changelog_page.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
35024	GLSA-200812-07 : Mantis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
34939	FreeBSD : mantis -- session hijacking vulnerability (00d6040a-b8e0-11dd-a578-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium
4694	Mantis < 1.1.4 HTTPS Session Cookie Secure Flag Weakness	Nessus Network Monitor	CGI	low
34456	Fedora 8 : mantis-1.1.4-1.fc8 (2008-9015)	Nessus	Fedora Local Security Checks	medium
34451	Fedora 9 : mantis-1.1.4-1.fc9 (2008-8925)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-3102

medium

Tenable Plugins

high

medium

low

medium

medium