PT-2013-3365 · Mozilla · Bugzilla

Publicado 2013-10-24 · Atualizado 2014-05-02 · CVE-2013-1734

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 4.0.x before 4.0.11 Bugzilla versions 4.1.x through 4.2.x before 4.2.7 Bugzilla versions 4.3.x through 4.4.x before 4.4.1

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via an update action. This occurs in the attachment.cgi component.

Recommendations For Bugzilla versions 2.x through 4.0.x before 4.0.11, update to version 4.0.11 or later. For Bugzilla versions 4.1.x through 4.2.x before 4.2.7, update to version 4.2.7 or later. For Bugzilla versions 4.3.x through 4.4.x before 4.4.1, update to version 4.4.1 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-1734

MGASA-2014-0199

Produtos afetados

Bugzilla

Referências · 11

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=913904 · Exploit
• http://mandriva.com/en/support/security/advisories/mbs1/MDVSA-2013:285 · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1734 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1734 · Nota
• https://advisories.mageia.org/MGASA-2014-0199.html · Nota de Segurança
• http://bugzilla.org/security/4.0.10 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0199 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=10897 · Nota
• http://bugzilla.org/releases/4.4.4/release-notes.html · Nota
• http://bugzilla.org/security/4.0.11 · Nota