Bugzilla Internal Error Cross-Site Scripting Vulnerability
BID:12154
Info
Bugzilla Internal Error Cross-Site Scripting Vulnerability
| Bugtraq ID: | 12154 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-1061 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 04 2005 12:00AM |
| Updated: | Jul 12 2009 09:26AM |
| Credit: | Discovery is credited to Michael Krax. |
| Vulnerable: |
Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.17 Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 Mozilla Bugzilla 2.14.5 Mozilla Bugzilla 2.14.4 Mozilla Bugzilla 2.14.3 Mozilla Bugzilla 2.14.2 Mozilla Bugzilla 2.14.1 Mozilla Bugzilla 2.14 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 |
| Not Vulnerable: | |
Discussion
Bugzilla Internal Error Cross-Site Scripting Vulnerability
Bugzilla is prone to a cross-site scripting vulnerability. The issue is exposed when the software renders internal errors that include user-supplied input.
An attacker may exploit this issue by enticing a user to follow a link that will cause hostile HTML and script code to be rendered in an internal error page. Exploitation may allow an attacker to steal cookie-based authentication credentials or to mount other attacks.
Bugzilla is prone to a cross-site scripting vulnerability. The issue is exposed when the software renders internal errors that include user-supplied input.
An attacker may exploit this issue by enticing a user to follow a link that will cause hostile HTML and script code to be rendered in an internal error page. Exploitation may allow an attacker to steal cookie-based authentication credentials or to mount other attacks.
Exploit / POC
Bugzilla Internal Error Cross-Site Scripting Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Bugzilla Internal Error Cross-Site Scripting Vulnerability
Solution:
The vendor has addressed this issue in CVS in the 2.18 and 2.16 branches. Additionally a patch is available from the following bug report:
https://bugzilla.mozilla.org/show_bug.cgi?id=272620
Conectiva Linux has released security advisory CLSA-2005:1040 addressing this issue. Users are advised to see the referenced advisory for details on obtaining and applying the appropriate updates.
Solution:
The vendor has addressed this issue in CVS in the 2.18 and 2.16 branches. Additionally a patch is available from the following bug report:
https://bugzilla.mozilla.org/show_bug.cgi?id=272620
Conectiva Linux has released security advisory CLSA-2005:1040 addressing this issue. Users are advised to see the referenced advisory for details on obtaining and applying the appropriate updates.
References
Bugzilla Internal Error Cross-Site Scripting Vulnerability
References:
References:
- Bug 272620 XSS vulnerability in internal error messages (Mozilla)
- Bugzilla Homepage (Mozilla)