Lucene search
MitreCVE-2010-4572HistoryJan 28, 2011 - 4:00 p.m.
CVE-2010-4572
2011-01-2816:00:02
CWE-94
mitre
web.nvd.nist.gov
36
bugzilla
crlf injection
vulnerability
chart.cgi
cve-2010-4572
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
8.9
Confidence
High
EPSS
0.01
Percentile
83.6%
CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.
Affected configurations
Node
mozillabugzillaRange≤3.2.9
ORmozillabugzillaMatch2.0
ORmozillabugzillaMatch2.2
ORmozillabugzillaMatch2.4
ORmozillabugzillaMatch2.6
ORmozillabugzillaMatch2.8
ORmozillabugzillaMatch2.9
ORmozillabugzillaMatch2.10
ORmozillabugzillaMatch2.12
ORmozillabugzillaMatch2.14
ORmozillabugzillaMatch2.14.1
ORmozillabugzillaMatch2.14.2
ORmozillabugzillaMatch2.14.3
ORmozillabugzillaMatch2.14.4
ORmozillabugzillaMatch2.14.5
ORmozillabugzillaMatch2.16
ORmozillabugzillaMatch2.16rc1
ORmozillabugzillaMatch2.16rc2
ORmozillabugzillaMatch2.16.1
ORmozillabugzillaMatch2.16.2
ORmozillabugzillaMatch2.16.3
ORmozillabugzillaMatch2.16.4
ORmozillabugzillaMatch2.16.5
ORmozillabugzillaMatch2.16.6
ORmozillabugzillaMatch2.16.7
ORmozillabugzillaMatch2.16.8
ORmozillabugzillaMatch2.16.9
ORmozillabugzillaMatch2.16.10
ORmozillabugzillaMatch2.16.11
ORmozillabugzillaMatch2.16_rc2
ORmozillabugzillaMatch2.17
ORmozillabugzillaMatch2.17.1
ORmozillabugzillaMatch2.17.2
ORmozillabugzillaMatch2.17.3
ORmozillabugzillaMatch2.17.4
ORmozillabugzillaMatch2.17.5
ORmozillabugzillaMatch2.17.6
ORmozillabugzillaMatch2.17.7
ORmozillabugzillaMatch2.18
ORmozillabugzillaMatch2.18rc1
ORmozillabugzillaMatch2.18rc2
ORmozillabugzillaMatch2.18rc3
ORmozillabugzillaMatch2.18.1
ORmozillabugzillaMatch2.18.2
ORmozillabugzillaMatch2.18.3
ORmozillabugzillaMatch2.18.4
ORmozillabugzillaMatch2.18.5
ORmozillabugzillaMatch2.18.6
ORmozillabugzillaMatch2.18.6\+
ORmozillabugzillaMatch2.18.7
ORmozillabugzillaMatch2.18.8
ORmozillabugzillaMatch2.18.9
ORmozillabugzillaMatch2.19
ORmozillabugzillaMatch2.19.1
ORmozillabugzillaMatch2.19.2
ORmozillabugzillaMatch2.19.3
ORmozillabugzillaMatch2.20
ORmozillabugzillaMatch2.20rc1
ORmozillabugzillaMatch2.20rc2
ORmozillabugzillaMatch2.20.1
ORmozillabugzillaMatch2.20.2
ORmozillabugzillaMatch2.20.3
ORmozillabugzillaMatch2.20.4
ORmozillabugzillaMatch2.20.5
ORmozillabugzillaMatch2.20.6
ORmozillabugzillaMatch2.20.7
ORmozillabugzillaMatch2.21
ORmozillabugzillaMatch2.21.1
ORmozillabugzillaMatch2.21.2
ORmozillabugzillaMatch2.22
ORmozillabugzillaMatch2.22rc1
ORmozillabugzillaMatch2.22.1
ORmozillabugzillaMatch2.22.2
ORmozillabugzillaMatch2.22.3
ORmozillabugzillaMatch2.22.4
ORmozillabugzillaMatch2.22.5
ORmozillabugzillaMatch2.22.6
ORmozillabugzillaMatch2.22.7
ORmozillabugzillaMatch2.23
ORmozillabugzillaMatch2.23.1
ORmozillabugzillaMatch2.23.2
ORmozillabugzillaMatch2.23.3
ORmozillabugzillaMatch2.23.4
ORmozillabugzillaMatch3.2
ORmozillabugzillaMatch3.2rc1
ORmozillabugzillaMatch3.2rc2
ORmozillabugzillaMatch3.2.1
ORmozillabugzillaMatch3.2.2
ORmozillabugzillaMatch3.2.3
ORmozillabugzillaMatch3.2.4
ORmozillabugzillaMatch3.2.5
ORmozillabugzillaMatch3.2.6
ORmozillabugzillaMatch3.2.7
ORmozillabugzillaMatch3.2.8
ORmozillabugzillaMatch3.4.1
ORmozillabugzillaMatch3.4.2
ORmozillabugzillaMatch3.4.3
ORmozillabugzillaMatch3.4.4
ORmozillabugzillaMatch3.4.5
ORmozillabugzillaMatch3.4.6
ORmozillabugzillaMatch3.4.7
ORmozillabugzillaMatch3.4.8
ORmozillabugzillaMatch3.4.9
ORmozillabugzillaMatch3.6.0
ORmozillabugzillaMatch3.6.1
ORmozillabugzillaMatch3.6.2
ORmozillabugzillaMatch3.6.3
ORmozillabugzillaMatch4.0
ORmozillabugzillaMatch4.0rc1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mozilla | bugzilla | 3.6.0 | cpe:/a:mozilla:bugzilla:3.6.0::: |
| mozilla | bugzilla | 2.2 | cpe:/a:mozilla:bugzilla:2.2::: |
| mozilla | bugzilla | 2.14 | cpe:/a:mozilla:bugzilla:2.14::: |
| mozilla | bugzilla | 2.20.5 | cpe:/a:mozilla:bugzilla:2.20.5::: |
| mozilla | bugzilla | 2.17.1 | cpe:/a:mozilla:bugzilla:2.17.1::: |
| mozilla | bugzilla | 2.16.6 | cpe:/a:mozilla:bugzilla:2.16.6::: |
| mozilla | bugzilla | 2.18.5 | cpe:/a:mozilla:bugzilla:2.18.5::: |
| mozilla | bugzilla | 2.17.4 | cpe:/a:mozilla:bugzilla:2.17.4::: |
| mozilla | bugzilla | 2.16 | cpe:/a:mozilla:bugzilla:2.16::: |
| mozilla | bugzilla | 3.4.6 | cpe:/a:mozilla:bugzilla:3.4.6::: |
References
lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
osvdb.org/70703
secunia.com/advisories/43033
secunia.com/advisories/43165
www.bugzilla.org/security/3.2.9/
www.debian.org/security/2011/dsa-2322
www.securityfocus.com/bid/45982
www.vupen.com/english/advisories/2011/0207
www.vupen.com/english/advisories/2011/0271
bugzilla.mozilla.org/show_bug.cgi?id=621572
exchange.xforce.ibmcloud.com/vulnerabilities/65440
Related
cvelist
cvelist
prion
prion
Crlf injection
2011-01-28 16:00:00
Design/Logic Flaw
2010-12-06 20:13:00
Hardcoded credentials
2010-12-06 20:12:00
nvd
nvd
ubuntucve
ubuntucve
freebsd
freebsd
bugzilla -- multiple serious vulnerabilities
2011-01-24 00:00:00
openvas
openvas
FreeBSD Ports: bugzilla
2011-03-05 00:00:00
Fedora Update for bugzilla FEDORA-2011-0741
2011-02-04 00:00:00
FreeBSD Ports: bugzilla
2011-03-05 00:00:00
nessus
nessus
Fedora 14 : bugzilla-3.6.4-1.fc14 (2011-0741)
2011-02-03 00:00:00
FreeBSD : bugzilla -- multiple serious vulnerabilities (c8c927e5-2891-11e0-8f26-00151735203a)
2011-01-26 00:00:00
Fedora 13 : bugzilla-3.4.10-1.fc13 (2011-0755)
2011-02-03 00:00:00
debiancve
debiancve
cve
cve
fedora
fedora
[SECURITY] Fedora 13 Update: perl-CGI-Simple-1.113-1.fc13
2011-01-30 19:48:24
[SECURITY] Fedora 14 Update: perl-CGI-Simple-1.113-1.fc14
2011-01-30 19:52:02
[SECURITY] Fedora 13 Update: perl-CGI-3.51-1.fc13
2011-01-31 19:51:59
veracode
veracode
HTTP Response Splitting
2020-04-10 00:59:28
securityvulns
securityvulns
[USN-1129-1] Perl vulnerabilities
2011-05-05 00:00:00
perl multiple security vulnerabilities
2011-05-20 00:00:00
[ MDVSA-2010:250 ] perl-CGI-Simple
2010-12-12 00:00:00
ubuntu
ubuntu
Perl vulnerabilities
2011-05-03 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 6 package perl-CGI version 3.49-alt2
2011-01-19 00:00:00
gentoo
gentoo
Bugzilla: Multiple vulnerabilities
2011-10-10 00:00:00
debian
debian
[SECURITY] [DSA 2322-1] bugzilla security update
2011-10-10 16:12:14
f5
f5
centos
centos
perl security update
2011-12-09 08:14:32
oraclelinux
oraclelinux
perl security update
2011-12-08 00:00:00
perl security and bug fix update
2011-05-28 00:00:00
redhat
redhat
(RHSA-2011:0558) Moderate: perl security and bug fix update
2011-05-19 00:00:00
(RHSA-2011:1797) Moderate: perl security update
2011-12-08 00:00:00
osv
osv
bugzilla - several
2011-10-10 00:00:00
vmware
vmware
VMware vSphere and vCOps updates to third party libraries
2012-08-30 00:00:00
VMware vSphere and vCOps updates to third party libraries
2012-08-30 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
8.9
Confidence
High
EPSS
0.01
Percentile
83.6%
Related for CVE-2010-4572