CVE-2008-4689: Mantis

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.

Affected products

• Mantis Mantis: up to and including 1.1.2; version 0.19.3 only; version 0.19.4 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; …

Published 2008-10-22. Last modified 2026-06-16.