CVE-2009-20001: MantisBT Insufficient Session Expiration Vulnerability
Summary
CVE-2009-20001: MantisBT Insufficient Session Expiration cookie string not reset after logout. Affects mantisbt/mantisbt versions < 2.24.5. Fixed in 2.24.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that provides a user-friendly interface for managing software development projects. It allows users to report bugs, track issues, and collaborate on project management. The application is widely used due to its flexibility and ease of integration with various development tools. However, prior to version 2.24.5, MantisBT had a critical vulnerability related to session management, which could lead to unauthorized access to user accounts.
Vulnerability Detail
The vulnerability identified as CVE-2009-20001 arises from MantisBT's failure to invalidate user sessions upon logout. When a user logs out, the unique cookie string associated with their session remains valid and active. This oversight allows an attacker who gains access to a user's cookie to impersonate that user, potentially leading to credential theft and unauthorized actions within the application. The vulnerability is classified under CWE-613, which pertains to insufficient session expiration.
How To Fix
Minimum fixed version
2.24.5
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.24.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should ensure that they clear their browser cookies after logging out of MantisBT. This can help prevent unauthorized access if a user's cookie is compromised. Additionally, implementing stricter session management policies, such as session timeouts, can further enhance security.
Conclusion
In summary, CVE-2009-20001 is a significant vulnerability in MantisBT that can lead to credential theft due to insufficient session expiration. Users are strongly advised to update to version 2.24.5 or later to mitigate this risk. Implementing additional security measures, such as clearing cookies after logout, can also help protect against potential exploits.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
CVE-2009-20001 is a vulnerability in MantisBT that allows an attacker to impersonate a user due to insufficient session expiration upon logout.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to unauthorized access to user accounts, allowing attackers to perform actions on behalf of legitimate users.
Yes, the vulnerability has been patched in MantisBT version 2.24.5. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
