CVE-2009-20001: MantisBT Insufficient Session Expiration cookie string not reset after logout

April 21, 2022 (updated June 9, 2025)

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user’s cookie to login as them.

References

github.com/advisories/GHSA-jm72-67rm-763j
github.com/mantisbt/mantisbt
github.com/mantisbt/mantisbt/commit/79a78c09d5ef5ce098adc73f6f1416f00fc238a5
mantisbt.org/bugs/view.php?id=11296
mantisbt.org/bugs/view.php?id=27976
nvd.nist.gov/vuln/detail/CVE-2009-20001

Code Behaviors & Features

Detect and mitigate CVE-2009-20001 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →