CVE-2009-1213

EPSS 0.7%

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bugzilla.mozilla.org/show_bug.cgi?id=476603 http://secunia.com/advisories/34545 http://secunia.com/advisories/34547 http://secunia.com/advisories/34624 https://exchange.xforce.ibmcloud.com/vulnerabilities/49524 https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html http://www.bugzilla.org/security/3.2.2/http://www.securityfocus.com/bid/34308 http://www.vupen.com/english/advisories/2009/0887