Bugzilla Cross Site Request Forgery and Security Bypass Vulnerabilities

Bugtraq ID:	53153
Class:	Design Error
CVE:	CVE-2012-0465 CVE-2012-0466
Remote:	Yes
Local:	No
Published:	Apr 18 2012 12:00AM
Updated:	Mar 19 2015 08:10AM
Credit:	Soroush Dalili and Frédéric Buclin
Vulnerable:	Red Hat Fedora 17 Red Hat Fedora 16 Red Hat Fedora 15 Mozilla Bugzilla 4.1.3 Mozilla Bugzilla 4.1.1 Mozilla Bugzilla 4.0.5 Mozilla Bugzilla 4.0.4 Mozilla Bugzilla 4.0.3 Mozilla Bugzilla 4.0.2 Mozilla Bugzilla 3.7.2 Mozilla Bugzilla 3.7.1 Mozilla Bugzilla 3.6.8 Mozilla Bugzilla 3.6.7 Mozilla Bugzilla 3.6.6 Mozilla Bugzilla 3.6.4 Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.5.3 Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.4.14 Mozilla Bugzilla 3.4.13 Mozilla Bugzilla 3.4.12 Mozilla Bugzilla 3.4.10 Mozilla Bugzilla 3.4.7 Mozilla Bugzilla 3.4.6 Mozilla Bugzilla 3.4.5 Mozilla Bugzilla 3.4.4 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.3.1 Mozilla Bugzilla 3.2.10 Mozilla Bugzilla 3.2.7 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.1.4 Mozilla Bugzilla 3.1.3 Mozilla Bugzilla 3.1.2 Mozilla Bugzilla 3.1.1 Mozilla Bugzilla 3.1 Mozilla Bugzilla 3.0.11 Mozilla Bugzilla 3.0.10 Mozilla Bugzilla 3.0.8 Mozilla Bugzilla 3.0.7 Mozilla Bugzilla 3.0.6 Mozilla Bugzilla 3.0.5 Mozilla Bugzilla 3.0.4 Mozilla Bugzilla 3.0.2 Mozilla Bugzilla 3.0.1 Mozilla Bugzilla 3.0 Mozilla Bugzilla 2.23.4 Mozilla Bugzilla 2.23.3 Mozilla Bugzilla 2.23.2 Mozilla Bugzilla 2.22.7 Mozilla Bugzilla 2.22.6 Mozilla Bugzilla 2.22.5 Mozilla Bugzilla 2.22.4 Mozilla Bugzilla 2.22.3 Mozilla Bugzilla 2.22.2 Mozilla Bugzilla 2.22.1 Mozilla Bugzilla 2.21.2 Mozilla Bugzilla 2.21.1 Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20.7 Mozilla Bugzilla 2.20.6 Mozilla Bugzilla 2.20.5 Mozilla Bugzilla 2.20.4 Mozilla Bugzilla 2.20.3 Mozilla Bugzilla 2.20.2 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.6 Mozilla Bugzilla 2.18.5 Mozilla Bugzilla 2.18.4 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.9 Mozilla Bugzilla 2.8 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 Mozilla Bugzilla 4.2 Mozilla Bugzilla 4.1 Mozilla Bugzilla 3.7.3 Mozilla Bugzilla 3.7.2 Mozilla Bugzilla 3.7 Mozilla Bugzilla 3.6.3 Mozilla Bugzilla 3.6.2 Mozilla Bugzilla 3.6 Mozilla Bugzilla 3.5 Mozilla Bugzilla 3.4.9 Mozilla Bugzilla 3.4.8 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.2rc2 Mozilla Bugzilla 3.2rc1 Mozilla Bugzilla 3.2.9 Mozilla Bugzilla 3.2.8 Mozilla Bugzilla 3.2 Mozilla Bugzilla 2.22 RC1 Mozilla Bugzilla 2.22 Mozilla Bugzilla 2.20
Not Vulnerable:	Mozilla Bugzilla 4.2.1 Mozilla Bugzilla 4.0.6 Mozilla Bugzilla 3.6.9

Bugzilla Cross Site Request Forgery and Security Bypass Vulnerabilities

An attacker can exploit these issues through a browser. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into following a malicious URI.

Bugzilla Cross Site Request Forgery and Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references for more information.