CVE-2009-1213

Опубликовано: 01 апр. 2009

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.

Ссылки

http://secunia.com/advisories/34545
Vendor Advisory
http://secunia.com/advisories/34547
Vendor Advisory
http://secunia.com/advisories/34624
http://www.bugzilla.org/security/3.2.2/
Patch
Vendor Advisory
http://www.securityfocus.com/bid/34308
http://www.vupen.com/english/advisories/2009/0887
Patch
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=476603
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49524
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html
http://secunia.com/advisories/34545
Vendor Advisory
http://secunia.com/advisories/34547
Vendor Advisory
http://secunia.com/advisories/34624
http://www.bugzilla.org/security/3.2.2/
Patch
Vendor Advisory
http://www.securityfocus.com/bid/34308
http://www.vupen.com/english/advisories/2009/0887
Patch
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=476603
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49524
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mozilla:bugzilla:3.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.2:rc1:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.2:rc2:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.3.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.3.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:bugzilla:3.3.3:*:*:*:*:*:*:*

EPSS

Процентиль: 57%

0.00347

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2009-1213

ubuntu

больше 16 лет назад

CVE-2009-1213

redhat

больше 16 лет назад

CVE-2009-1213

debian

больше 16 лет назад

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in B ...

GHSA-h5vc-337f-mrrj

github

больше 3 лет назад

EPSS

Процентиль: 57%

0.00347

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352