CVE-2014-1546
Summary
| CVE | CVE-2014-1546 |
|---|---|
| State | PUBLISHED |
| Assigner | mozilla |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-08-14 11:15:23 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with the _bz_callback character set. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mozilla | Bugzilla | 3.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.0.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.11 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.2 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 3.2.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.4.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.11 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.12 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.13 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.6.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.11 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.12 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.13 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 4.0 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 4.0.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.10 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.11 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.12 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.13 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.5 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.6 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.7 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.8 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.9 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 4.2 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 4.2.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.5 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.6 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.7 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.8 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.9 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4 | - | All | All |
| Application | Mozilla | Bugzilla | 4.4 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 4.4 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 4.4.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.4 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 19 Update: bugzilla-4.2.10-1.fc19 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Mageia Advisory: MGASA-2014-0349 - Updated bugzilla packages fix a CSRF vulnerability | af854a3a-2127-422b-91ae-364da2661108 | advisories.mageia.org | |
| Bugzilla Input Validation Flaw in JSONP Endpoint Permits Cross-Site Request Forgery Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| [SECURITY] Fedora 20 Update: bugzilla-4.2.10-1.fc20 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| 1036213 – (CVE-2014-1546) [SECURITY] Add '/**/' before jsonrpc.cgi callback to avoid swf content type sniff vulnerability | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | Vendor Advisory |
| www.mandriva.com | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.