Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) sortkey parameter.

Multiple vulnerabilities was found and corrected in bugzilla :

Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision token (CVE-2013-1733).

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via an update action (CVE-2013-1734).

Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) sortkey parameter (CVE-2013-1742).

Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as demonstrated by the (1) summary or (2) real name field. NOTE: this issue exists because of an incomplete fix for CVE-2012-4189 (CVE-2013-1743).

The updated packages have been upgraded to the 4.2.7 version which is not affected by these issues.

The following security issues have been discovered in Bugzilla 4.2.6 :

  - A CSRF vulnerability in attachment.cgi can lead to an     attachment being edited without the user consent.

  - Several unfiltered parameters when editing flagtypes can     lead to XSS.

  - Due to an incomplete fix for CVE-2012-4189, some     incorrectly filtered field values in tabular reports can     lead to XSS.

Version 4.2.7 (this one) fixes all these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Bugzilla installed on the remote host is affected by multiple vulnerabilities :

  - A cross-site request forgery vulnerability exists due to     a flaw in token validation in 'process_bug.cgi'.  Note     that this only affects versions 4.4rc1 to 4.4.
    (CVE-2013-1733)

  - A cross-site request forgery vulnerability exists due to     a flaw in the validation of HTTP requests when updating     attachments with the 'attachment.cgi' script.  Note that     this affects versions 2.16rc1 to 4.0.10, 4.1.1 to 4.2.6,     and 4.3.1 to 4.4. (CVE-2013-1734)

  - A cross-site scripting vulnerability exists due to     improper parameter validation in 'editflagtypes.cgi'.
    Note that this affects versions 2.17.1 to 4.0.10, 4.1.1     to 4.2.6, and 4.3.1 to 4.4. (CVE-2013-1742)

  - A cross-site scripting vulnerability exists due to     incorrectly filtered field values in tabular reports.
    Note that this affects 4.1.1 to 4.2.6 and 4.3.1 to 4.4.
    (CVE-2013-1743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A Bugzilla Security Advisory reports:Cross-Site Request Forgery When a user submits changes to a bug right after another user did, a midair collision page is displayed to inform the user about changes recently made. This page contains a token which can be used to validate the changes if the user decides to submit his changes anyway. A regression in Bugzilla 4.4 caused this token to be recreated if a crafted URL was given, even when no midair collision page was going to be displayed, allowing an attacker to bypass the token check and abuse a user to commit changes on his behalf. Cross-Site Request Forgery When an attachment is edited, a token is generated to validate changes made by the user. Using a crafted URL, an attacker could force the token to be recreated, allowing him to bypass the token check and abuse a user to commit changes on his behalf. Cross-Site Scripting Some parameters passed to editflagtypes.cgi were not correctly filtered in the HTML page, which could lead to XSS. Cross-Site Scripting Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered field values in tabular reports could lead to XSS.

ID	Name	Product	Family	Severity
71099	Mandriva Linux Security Advisory : bugzilla (MDVSA-2013:285)	Nessus	Mandriva Local Security Checks	medium
70819	Fedora 20 : bugzilla-4.2.7-1.fc20 (2013-19402)	Nessus	Fedora Local Security Checks	medium
70720	Bugzilla < 4.0.11 / 4.2.7 / 4.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
70668	Fedora 19 : bugzilla-4.2.7-1.fc19 (2013-19480)	Nessus	Fedora Local Security Checks	medium
70667	Fedora 18 : bugzilla-4.2.7-1.fc18 (2013-19458)	Nessus	Fedora Local Security Checks	medium
70485	FreeBSD : bugzilla -- multiple vulnerabilities (e135f0c9-375f-11e3-80b7-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-1742

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium