CVE-2009-1213

2009-04-0110:30:00

CWE-352

[email protected]

web.nvd.nist.gov

cve-2009-1213

cross-site request forgery

csrf

bugzilla 3.2

bugzilla vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.6%

JSON

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.

Affected configurations

NVD

Node

mozillabugzillaMatch3.2

mozillabugzillaMatch3.2rc1

mozillabugzillaMatch3.2rc2

mozillabugzillaMatch3.2.1

mozillabugzillaMatch3.2.2

mozillabugzillaMatch3.3

mozillabugzillaMatch3.3.1

mozillabugzillaMatch3.3.2

mozillabugzillaMatch3.3.3

CPENameOperatorVersion
mozilla:bugzillamozilla bugzillaeq3.2
mozilla:bugzillamozilla bugzillaeq3.2.1
mozilla:bugzillamozilla bugzillaeq3.2.2
mozilla:bugzillamozilla bugzillaeq3.3
mozilla:bugzillamozilla bugzillaeq3.3.1
mozilla:bugzillamozilla bugzillaeq3.3.2
mozilla:bugzillamozilla bugzillaeq3.3.3

CPE	Name	Operator	Version
mozilla:bugzilla	mozilla bugzilla	eq	3.2
mozilla:bugzilla	mozilla bugzilla	eq	3.2.1
mozilla:bugzilla	mozilla bugzilla	eq	3.2.2
mozilla:bugzilla	mozilla bugzilla	eq	3.3
mozilla:bugzilla	mozilla bugzilla	eq	3.3.1
mozilla:bugzilla	mozilla bugzilla	eq	3.3.2
mozilla:bugzilla	mozilla bugzilla	eq	3.3.3