| Vulnerability Name: | CVE-2006-5453 (CCN-29610) | ||||||||
| Assigned: | 2006-10-15 | ||||||||
| Published: | 2006-10-15 | ||||||||
| Updated: | 2018-10-17 | ||||||||
| Summary: | Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, (2) description fields of certain items in various edit cgi scripts, and (3) the id parameter in showdependencygraph.cgi. This vulnerability is addressed in the following product releases: Mozilla, Bugzilla, 2.18.6 Mozilla, Bugzilla, 2.20.3 Mozilla, Bugzilla, 2.22.1 Mozilla, Bugzilla, 2.23.3 | ||||||||
| CVSS v3 Severity: | 2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N) 3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
1.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Sun Oct 15 2006 - 05:02:20 CDT Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2 Source: MITRE Type: CNA CVE-2006-5453 Source: CCN Type: SA22409 Bugzilla Multiple Vulnerabilities Source: SECUNIA Type: UNKNOWN 22409 Source: SECUNIA Type: UNKNOWN 22790 Source: SECUNIA Type: UNKNOWN 22826 Source: GENTOO Type: UNKNOWN GLSA-200611-04 Source: SREASON Type: UNKNOWN 1760 Source: CCN Type: SECTRACK ID: 1017063 Bugzilla Input Validation Holes Permit Cross-Site Scripting Attacks Source: SECTRACK Type: Patch 1017063 Source: CCN Type: Bugzilla Web site 2.18.5, 2.20.2, 2.22, and 2.23.2 Security Advisory Source: CONFIRM Type: UNKNOWN http://www.bugzilla.org/security/2.18.5/ Source: DEBIAN Type: UNKNOWN DSA-1208 Source: DEBIAN Type: DSA-1208 bugzilla -- several vulnerabilities Source: CCN Type: GLSA-200611-04 Bugzilla: Multiple Vulnerabilities Source: OSVDB Type: UNKNOWN 29544 Source: OSVDB Type: Patch 29545 Source: OSVDB Type: UNKNOWN 29549 Source: CCN Type: OSVDB ID: 29544 Bugzilla Page Header XSS Source: CCN Type: OSVDB ID: 29545 Bugzilla Multiple Description Field XSS Source: CCN Type: OSVDB ID: 29549 Bugzilla showdependencygraph.cgi XSS Source: BUGTRAQ Type: UNKNOWN 20061015 Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2 Source: BID Type: UNKNOWN 20538 Source: CCN Type: BID-20538 Mozilla Bugzilla Multiple Input Validation and Information disclosure Vulnerabilities Source: VUPEN Type: UNKNOWN ADV-2006-4035 Source: CONFIRM Type: Patch https://bugzilla.mozilla.org/show_bug.cgi?id=206037 Source: CONFIRM Type: Patch https://bugzilla.mozilla.org/show_bug.cgi?id=330555 Source: CONFIRM Type: Patch https://bugzilla.mozilla.org/show_bug.cgi?id=355728 Source: XF Type: UNKNOWN bugzilla-h1h2-tags-xss(29610) Source: XF Type: UNKNOWN bugzilla-h1h2-tags-xss(29610) Source: XF Type: UNKNOWN bugzilla-showdependencygraph(29619) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2006-5453 (CCN-29612) | ||||||||
| Assigned: | 2006-10-15 | ||||||||
| Published: | 2006-10-15 | ||||||||
| Updated: | 2018-10-17 | ||||||||
| Summary: | This vulnerability is addressed in the following product releases:
Mozilla, Bugzilla, 2.18.6 Mozilla, Bugzilla, 2.20.3 Mozilla, Bugzilla, 2.22.1 Mozilla, Bugzilla, 2.23.3 | ||||||||
| CVSS v3 Severity: | 3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N) 3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
3.1 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Sun Oct 15 2006 - 05:02:20 CDT Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2 Source: MITRE Type: CNA CVE-2006-5453 Source: CCN Type: SA22409 Bugzilla Multiple Vulnerabilities Source: CCN Type: SECTRACK ID: 1017063 Bugzilla Input Validation Holes Permit Cross-Site Scripting Attacks Source: CCN Type: Bugzilla Web site 2.18.5, 2.20.2, 2.22, and 2.23.2 Security Advisory Source: DEBIAN Type: DSA-1208 bugzilla -- several vulnerabilities Source: CCN Type: GLSA-200611-04 Bugzilla: Multiple Vulnerabilities Source: CCN Type: OSVDB ID: 29544 Bugzilla Page Header XSS Source: CCN Type: OSVDB ID: 29545 Bugzilla Multiple Description Field XSS Source: CCN Type: OSVDB ID: 29549 Bugzilla showdependencygraph.cgi XSS Source: CCN Type: BID-20538 Mozilla Bugzilla Multiple Input Validation and Information disclosure Vulnerabilities Source: XF Type: UNKNOWN bugzilla-description-fields-xss(29612) | ||||||||
| Vulnerability Name: | CVE-2006-5453 (CCN-29619) | ||||||||
| Assigned: | 2006-10-15 | ||||||||
| Published: | 2006-10-15 | ||||||||
| Updated: | 2006-10-15 | ||||||||
| Summary: | Bugzilla is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the showdependencygraph.cgi script. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. | ||||||||
| CVSS v3 Severity: | 2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N) 3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
1.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Sun Oct 15 2006 - 05:02:20 CDT Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2 Source: MITRE Type: CNA CVE-2006-5453 Source: CCN Type: SA22409 Bugzilla Multiple Vulnerabilities Source: CCN Type: SECTRACK ID: 1017063 Bugzilla Input Validation Holes Permit Cross-Site Scripting Attacks Source: CCN Type: Bugzilla Web site 2.18.5, 2.20.2, 2.22, and 2.23.2 Security Advisory Source: CCN Type: GLSA-200611-04 Bugzilla: Multiple Vulnerabilities Source: CCN Type: OSVDB ID: 29544 Bugzilla Page Header XSS Source: CCN Type: OSVDB ID: 29545 Bugzilla Multiple Description Field XSS Source: CCN Type: OSVDB ID: 29549 Bugzilla showdependencygraph.cgi XSS Source: CCN Type: BID-20538 Mozilla Bugzilla Multiple Input Validation and Information disclosure Vulnerabilities Source: XF Type: UNKNOWN bugzilla-showdependencygraph-xss(29619) | ||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||