Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability

Bugtraq ID:	34308
Class:	Design Error
CVE:	CVE-2009-1213
Remote:	Yes
Local:	No
Published:	Mar 30 2009 12:00AM
Updated:	Apr 13 2015 09:32PM
Credit:	Dave Miller <br>
Vulnerable:	Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.3.1 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.2 Gentoo Linux
Not Vulnerable:	Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.2.3

Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability

Bugzilla is prone to a cross-site request-forgery vulnerability.

An attacker can exploit this issue to submit attachments in the context of the logged-in user.

This issue affects versions prior to Bugzilla 3.2.3 and 3.3.4.

Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability

To exploit the issue, an attacker must entice a user into visiting a malicious site.

Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability

References:

• 3.2.2 and 3.3.3 Security Advisory (Mozilla)
  
• Bugzilla Homepage (Mozilla)