CVE-2009-20001

Published: Mar 7, 2021Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.

Affected (1)

Products: Mantisbt: Mantisbt

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mantisbt Mantisbt	Before 2.24.5

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

https://mantisbt.org/bugs/view.php?id=11296

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://mantisbt.org/bugs/view.php?id=27976

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

https://mantisbt.org/bugs/view.php?id=11296

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://mantisbt.org/bugs/view.php?id=27976

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.