PT-2012-2574 · Mozilla+1 · Bugzilla+1

Mario Gomes · Publicado 2012-02-25 · Atualizado 2018-01-11 · CVE-2012-0453

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 4.0.2 through 4.0.4 Bugzilla versions 4.1.1 through 4.2rc2

Description A cross-site request forgery issue affects the xmlrpc.cgi component in Bugzilla when mod perl is used. This allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.

Recommendations For Bugzilla versions 4.0.2 through 4.0.4, update to a version outside of this range to resolve the issue. For Bugzilla versions 4.1.1 through 4.2rc2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the xmlrpc.cgi component until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-0453

Produtos afetados

Bugzilla

Mod Perl

Referências · 5

• https://bugzilla.mozilla.org/show_bug.cgi?id=725663 · Correção
• http://bugzilla.org/security/4.0.4 · Aviso do Fabricante
• http://securitytracker.com/id?1026737 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0453 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0453 · Nota de Segurança