| Vulnerability Name: | CVE-2011-0046 (CCN-65002) |
| Assigned: | 2010-12-21 |
| Published: | 2011-01-24 |
| Updated: | 2017-08-17 |
| Summary: | Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
|
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV):
Access Complexity (AC):
Authentication (Au): | | Impact Metrics: | Confidentiality (C):
Integrity (I):
Availibility (A): |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV):
Access Complexity (AC):
Athentication (Au):
| | Impact Metrics: | Confidentiality (C):
Integrity (I):
Availibility (A): |
|
| Vulnerability Type: | CWE-352
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-2011-0046
Source: FEDORA
Type: UNKNOWN
FEDORA-2011-0741
Source: FEDORA
Type: UNKNOWN
FEDORA-2011-0755
Source: OSVDB
Type: UNKNOWN
70705
Source: OSVDB
Type: UNKNOWN
70706
Source: OSVDB
Type: UNKNOWN
70707
Source: OSVDB
Type: UNKNOWN
70708
Source: OSVDB
Type: UNKNOWN
70709
Source: OSVDB
Type: UNKNOWN
70710
Source: CCN
Type: SA43033
Bugzilla Multiple Vulnerabilities
Source: SECUNIA
Type: Vendor Advisory
43033
Source: SECUNIA
Type: UNKNOWN
43165
Source: CCN
Type: Bugzilla Web Site
3.2.9, 3.4.9, 3.6.3, and 4.0rc1 Security Advisory
Source: CONFIRM
Type: Vendor Advisory
http://www.bugzilla.org/security/3.2.9/
Source: DEBIAN
Type: UNKNOWN
DSA-2322
Source: DEBIAN
Type: DSA-2322
bugzilla -- several vulnerabilities
Source: CCN
Type: OSVDB ID: 70705
Bugzilla buglist.cgi Saved Search Addition CSRF
Source: CCN
Type: OSVDB ID: 70706
Bugzilla votes.cgi Authentication Hijack CSRF
Source: CCN
Type: OSVDB ID: 70707
Bugzilla sanitycheck.cgi Authentication Hijack CSRF
Source: CCN
Type: OSVDB ID: 70708
Bugzilla chart.cgi Chart Manipulation CSRF
Source: CCN
Type: OSVDB ID: 70709
Bugzilla colchange.cgi Column Manipulation CSRF
Source: CCN
Type: OSVDB ID: 70710
Bugzilla quips.cgi Quip Moderation CSRF
Source: BID
Type: UNKNOWN
45982
Source: CCN
Type: BID-45982
Bugzilla Multiple Vulnerabilities
Source: VUPEN
Type: Vendor Advisory
ADV-2011-0207
Source: VUPEN
Type: UNKNOWN
ADV-2011-0271
Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=621090
Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=621105
Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=621107
Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=621108
Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=621109
Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=621110
Source: XF
Type: UNKNOWN
bugzilla-perl-response-splitting(65002)
Source: XF
Type: UNKNOWN
bugzilla-unspec-csrf(65003)
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:mozilla:bugzilla:2.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.12:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.14:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.14.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.14.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.14.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.14.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.14.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16:rc1:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16:rc2:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16.11:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.16_rc2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.17.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18:rc1:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18:rc2:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18:rc3:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.6+:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.18.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.19:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.19.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.19.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.19.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20:rc1:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20:rc2:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.20.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.21:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.21.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.21.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22:rc1:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.22.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.23:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.23.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.23.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.23.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:2.23.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2:rc1:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2:rc2:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:*:*:*:*:*:*:*:* (Version <= 3.2.9)OR cpe:/a:mozilla:bugzilla:3.4.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.6.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.6.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.6.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.6.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:4.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:4.0:rc1:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Vulnerability Name: | CVE-2011-0046 (CCN-65003) |
| Assigned: | 2010-12-21 |
| Published: | 2011-01-24 |
| Updated: | 2011-01-24 |
| Summary: | Bugzilla is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities. |
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV):
Access Complexity (AC):
Authentication (Au): | | Impact Metrics: | Confidentiality (C):
Integrity (I):
Availibility (A): |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV):
Access Complexity (AC):
Athentication (Au):
| | Impact Metrics: | Confidentiality (C):
Integrity (I):
Availibility (A): |
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-2011-0046
Source: CCN
Type: SA43033
Bugzilla Multiple Vulnerabilities
Source: CCN
Type: Bugzilla Web Site
3.2.9, 3.4.9, 3.6.3, and 4.0rc1 Security Advisory
Source: DEBIAN
Type: DSA-2322
bugzilla -- several vulnerabilities
Source: CCN
Type: OSVDB ID: 70705
Bugzilla buglist.cgi Saved Search Addition CSRF
Source: CCN
Type: OSVDB ID: 70706
Bugzilla votes.cgi Authentication Hijack CSRF
Source: CCN
Type: OSVDB ID: 70707
Bugzilla sanitycheck.cgi Authentication Hijack CSRF
Source: CCN
Type: OSVDB ID: 70708
Bugzilla chart.cgi Chart Manipulation CSRF
Source: CCN
Type: OSVDB ID: 70709
Bugzilla colchange.cgi Column Manipulation CSRF
Source: CCN
Type: OSVDB ID: 70710
Bugzilla quips.cgi Quip Moderation CSRF
Source: CCN
Type: BID-45982
Bugzilla Multiple Vulnerabilities
Source: XF
Type: UNKNOWN
bugzilla-unspec-csrf(65003)
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/a:mozilla:bugzilla:3.2.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2:rc1:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.2.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.4.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:bugzilla:3.6.1:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |