Detections
Analytics
Bugzilla < 3.2.10 / 3.4.10 / 3.6.4 Multiple Vulnerabilities
low Nessus Network Monitor Plugin ID 5744
Synopsis
The remote web server is hosting an application that is vulnerable to multiple attack vectors.Description
The remote web server is hosting Bugzilla, a web-based bug tracking application.Versions of Bugzilla 3.2.x earlier than 3.2.10, 3.4.x earlier than 3.4.10, and 3.6.x earlier than 3.6.4 are potentially affected by multiple vulnerabilities :
- A weakness could allow a user to gain unauthorized access to another Bugzilla account.
- A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages.
- It is possible to insert harmful 'javascript:' or 'data:' URLs into Bugzilla's 'URL' field which in some cases Buzilla will make clickable.
- Various pages lack protection against cross-site request forgeries.
Solution
Upgrade to Bugzilla 3.2.10, 3.4.10, 3.6.4 or later.See Also
Plugin Details
Severity: Low
ID: 5744
Family: CGI
Published: 11/25/2010
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:bugzilla
Patch Publication Date: 11/24/2010
Vulnerability Publication Date: 11/24/2010
Reference Information
CVE: CVE-2010-2761, CVE-2010-4410, CVE-2010-4411, CVE-2010-4567, CVE-2010-4568, CVE-2010-4572, CVE-2011-0046, CVE-2011-0048