Unscored severity · published Sep 24, 2008
CVE-2008-3102
Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mantisbt · Mantisbt
1.1.0; 1.1.1; 1.1.2; 1.2.0a1; 1.2.0a2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3102
int21.de
http://int21.de/cve/CVE-2008-3102-mantis.html
Vendor Advisory
http://secunia.com/advisories/32243
Vendor Advisory
http://secunia.com/advisories/32330
Vendor Advisory
http://secunia.com/advisories/32975
securityreason.com
http://securityreason.com/securityalert/4298
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml
More from Mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php