Basic search

K
freebsdFreeBSD0C7A3EE2-3654-11E1-B404-20CF30E32F6D
HistoryNov 28, 2011 - 12:00 a.m.

bugzilla -- multiple vulnerabilities

2011-11-2800:00:00
vuxml.freebsd.org
7

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.7%

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

Tabular and graphical reports, as well as new charts have
a debug mode which displays raw data as plain text. This
text is not correctly escaped and a crafted URL could use
this vulnerability to inject code leading to XSS.
The User.offer_account_by_email WebService method ignores
the user_can_create_account setting of the authentication
method and generates an email with a token in it which the
user can use to create an account. Depending on the
authentication method being active, this could allow the
user to log in using this account.
Installations where the createemailregexp parameter is
empty are not vulnerable to this issue.
The creation of bug reports and of attachments is not
protected by a token and so they can be created without the
consent of a user if the relevant code is embedded in an
HTML page and the user visits this page. This behavior was
intentional to let third-party applications submit new bug
reports and attachments easily. But as this behavior can be
abused by a malicious user, it has been decided to block
submissions with no valid token starting from version 4.2rc1.
Older branches are not patched to not break these third-party
applications after the upgrade.

All affected installations are encouraged to upgrade as soon
as possible.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchbugzilla= 2.4.*UNKNOWN
FreeBSDanynoarchbugzilla< 3.6.7UNKNOWN

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.7%

Related for 0C7A3EE2-3654-11E1-B404-20CF30E32F6D