Lucene search

MitreCVE-2011-0046

HistoryJan 28, 2011 - 4:00 p.m.

CVE-2011-0046

2011-01-2816:00:02

CWE-352

mitre

web.nvd.nist.gov

cve-2011-0046

bugzilla

csrf

cross-site request forgery

vulnerability

remote attackers

authentication

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

Low

EPSS

0.004

Percentile

72.8%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.

Affected configurations

Nvd

Node

mozillabugzillaRange≤3.2.9

mozillabugzillaMatch2.0

mozillabugzillaMatch2.2

mozillabugzillaMatch2.4

mozillabugzillaMatch2.6

mozillabugzillaMatch2.8

mozillabugzillaMatch2.9

mozillabugzillaMatch2.10

mozillabugzillaMatch2.12

mozillabugzillaMatch2.14

mozillabugzillaMatch2.14.1

mozillabugzillaMatch2.14.2

mozillabugzillaMatch2.14.3

mozillabugzillaMatch2.14.4

mozillabugzillaMatch2.14.5

mozillabugzillaMatch2.16

mozillabugzillaMatch2.16rc1

mozillabugzillaMatch2.16rc2

mozillabugzillaMatch2.16.1

mozillabugzillaMatch2.16.2

mozillabugzillaMatch2.16.3

mozillabugzillaMatch2.16.4

mozillabugzillaMatch2.16.5

mozillabugzillaMatch2.16.6

mozillabugzillaMatch2.16.7

mozillabugzillaMatch2.16.8

mozillabugzillaMatch2.16.9

mozillabugzillaMatch2.16.10

mozillabugzillaMatch2.16.11

mozillabugzillaMatch2.16_rc2

mozillabugzillaMatch2.17

mozillabugzillaMatch2.17.1

mozillabugzillaMatch2.17.2

mozillabugzillaMatch2.17.3

mozillabugzillaMatch2.17.4

mozillabugzillaMatch2.17.5

mozillabugzillaMatch2.17.6

mozillabugzillaMatch2.17.7

mozillabugzillaMatch2.18

mozillabugzillaMatch2.18rc1

mozillabugzillaMatch2.18rc2

mozillabugzillaMatch2.18rc3

mozillabugzillaMatch2.18.1

mozillabugzillaMatch2.18.2

mozillabugzillaMatch2.18.3

mozillabugzillaMatch2.18.4

mozillabugzillaMatch2.18.5

mozillabugzillaMatch2.18.6

mozillabugzillaMatch2.18.6\+

mozillabugzillaMatch2.18.7

mozillabugzillaMatch2.18.8

mozillabugzillaMatch2.18.9

mozillabugzillaMatch2.19

mozillabugzillaMatch2.19.1

mozillabugzillaMatch2.19.2

mozillabugzillaMatch2.19.3

mozillabugzillaMatch2.20

mozillabugzillaMatch2.20rc1

mozillabugzillaMatch2.20rc2

mozillabugzillaMatch2.20.1

mozillabugzillaMatch2.20.2

mozillabugzillaMatch2.20.3

mozillabugzillaMatch2.20.4

mozillabugzillaMatch2.20.5

mozillabugzillaMatch2.20.6

mozillabugzillaMatch2.20.7

mozillabugzillaMatch2.21

mozillabugzillaMatch2.21.1

mozillabugzillaMatch2.21.2

mozillabugzillaMatch2.22

mozillabugzillaMatch2.22rc1

mozillabugzillaMatch2.22.1

mozillabugzillaMatch2.22.2

mozillabugzillaMatch2.22.3

mozillabugzillaMatch2.22.4

mozillabugzillaMatch2.22.5

mozillabugzillaMatch2.22.6

mozillabugzillaMatch2.22.7

mozillabugzillaMatch2.23

mozillabugzillaMatch2.23.1

mozillabugzillaMatch2.23.2

mozillabugzillaMatch2.23.3

mozillabugzillaMatch2.23.4

mozillabugzillaMatch3.2

mozillabugzillaMatch3.2rc1

mozillabugzillaMatch3.2rc2

mozillabugzillaMatch3.2.1

mozillabugzillaMatch3.2.2

mozillabugzillaMatch3.2.3

mozillabugzillaMatch3.2.4

mozillabugzillaMatch3.2.5

mozillabugzillaMatch3.2.6

mozillabugzillaMatch3.2.7

mozillabugzillaMatch3.2.8

mozillabugzillaMatch3.4.1

mozillabugzillaMatch3.4.2

mozillabugzillaMatch3.4.3

mozillabugzillaMatch3.4.4

mozillabugzillaMatch3.4.5

mozillabugzillaMatch3.4.6

mozillabugzillaMatch3.4.7

mozillabugzillaMatch3.4.8

mozillabugzillaMatch3.4.9

mozillabugzillaMatch3.6.0

mozillabugzillaMatch3.6.1

mozillabugzillaMatch3.6.2

mozillabugzillaMatch3.6.3

mozillabugzillaMatch4.0

mozillabugzillaMatch4.0rc1

VendorProductVersionCPE
mozillabugzilla*cpe:2.3:a:mozilla:bugzilla:*:*:*:*:*:*:*:*
mozillabugzilla2.0cpe:2.3:a:mozilla:bugzilla:2.0:*:*:*:*:*:*:*
mozillabugzilla2.2cpe:2.3:a:mozilla:bugzilla:2.2:*:*:*:*:*:*:*
mozillabugzilla2.4cpe:2.3:a:mozilla:bugzilla:2.4:*:*:*:*:*:*:*
mozillabugzilla2.6cpe:2.3:a:mozilla:bugzilla:2.6:*:*:*:*:*:*:*
mozillabugzilla2.8cpe:2.3:a:mozilla:bugzilla:2.8:*:*:*:*:*:*:*
mozillabugzilla2.9cpe:2.3:a:mozilla:bugzilla:2.9:*:*:*:*:*:*:*
mozillabugzilla2.10cpe:2.3:a:mozilla:bugzilla:2.10:*:*:*:*:*:*:*
mozillabugzilla2.12cpe:2.3:a:mozilla:bugzilla:2.12:*:*:*:*:*:*:*
mozillabugzilla2.14cpe:2.3:a:mozilla:bugzilla:2.14:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	bugzilla	*	cpe:2.3:a:mozilla:bugzilla::::::::
mozilla	bugzilla	2.0	cpe:2.3:a:mozilla:bugzilla:2.0:::::::*
mozilla	bugzilla	2.2	cpe:2.3:a:mozilla:bugzilla:2.2:::::::*
mozilla	bugzilla	2.4	cpe:2.3:a:mozilla:bugzilla:2.4:::::::*
mozilla	bugzilla	2.6	cpe:2.3:a:mozilla:bugzilla:2.6:::::::*
mozilla	bugzilla	2.8	cpe:2.3:a:mozilla:bugzilla:2.8:::::::*
mozilla	bugzilla	2.9	cpe:2.3:a:mozilla:bugzilla:2.9:::::::*
mozilla	bugzilla	2.10	cpe:2.3:a:mozilla:bugzilla:2.10:::::::*
mozilla	bugzilla	2.12	cpe:2.3:a:mozilla:bugzilla:2.12:::::::*
mozilla	bugzilla	2.14	cpe:2.3:a:mozilla:bugzilla:2.14:::::::*