Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, (2) description fields of certain items in various edit cgi scripts, and (3) the id parameter in showdependencygraph.cgi.

The remote host is affected by the vulnerability described in GLSA-200611-04 (Bugzilla: Multiple Vulnerabilities)

    The vulnerabilities identified in Bugzilla are as follows:
    Frederic Buclin and Gervase Markham discovered that input passed to     various fields throughout Bugzilla were not properly sanitized before     being sent back to users (CVE-2006-5453).
    Frederic Buclin and Josh 'timeless' Soref discovered a bug when     viewing attachments in diff mode that allows users not of the     'insidergroup' to read attachment descriptions. Additionally, it was     discovered that the 'deadline' field is visible to users who do not     belong to the 'timetrackinggroup' when bugs are exported to XML     (CVE-2006-5454).
    Gavin Shelley reported that Bugzilla allows certain operations to     be performed via HTTP GET and HTTP POST requests without verifying     those requests properly (CVE-2006-5455).
    Max Kanat-Alexander discovered that input passed to     showdependencygraph.cgi is not properly sanitized before being returned     to users (CVE-2006-5453).
  Impact :

    An attacker could inject scripts into the content loaded by a user's     browser in order to have those scripts executed in a user's browser in     the context of the site currently being viewed. This could include     gaining access to privileged session information for the site being     viewed. Additionally, a user could forge an HTTP request in order to     create, modify, or delete bugs within a Bugzilla instance. Lastly, an     unauthorized user could view sensitive information about bugs or bug     attachments.
  Workaround :

    There is no known workaround at this time.

A Bugzilla Security Advisory reports :

- Sometimes the information put into the <h1> and <h2> tags in Bugzilla was not properly escaped, leading to a possible XSS vulnerability.

- Bugzilla administrators were allowed to put raw, unfiltered HTML into many fields in Bugzilla, leading to a possible XSS vulnerability.
Now, the HTML allowed in those fields is limited.

- attachment.cgi could leak the names of private attachments

- The 'deadline' field was visible in the XML format of a bug, even to users who were not a member of the 'timetrackinggroup.'

- A malicious user could pass a URL to an admin, and make the admin delete or change something that he had not intended to delete or change.

- It is possible to inject arbitrary HTML into the showdependencygraph.cgi page, allowing for a cross-site scripting attack.

Several remote vulnerabilities have been discovered in the Bugzilla bug tracking system, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4534     Javier Fernandez-Sanguino Pena discovered that     insecure temporary file usage may lead to denial of     service through a symlink attack.

  - CVE-2006-5453     Several cross-site scripting vulnerabilities may lead to     injection of arbitrary web script code.

ID	Name	Product	Family	Severity
23669	GLSA-200611-04 : Bugzilla: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
23664	FreeBSD : bugzilla -- multiple vulnerabilities (6d68618a-7199-11db-a2ad-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium
23657	Debian DSA-1208-1 : bugzilla - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2006-5453

medium

Tenable Plugins

medium

medium

high