Bugzilla CVE-2014-1517 Cross Site Request Forgery Vulnerability
BID:66984
Info
Bugzilla CVE-2014-1517 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 66984 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-1517 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2014 12:00AM |
| Updated: | Apr 13 2015 10:21PM |
| Credit: | Reed Loden |
| Vulnerable: |
Mozilla Bugzilla 4.2.5 Mozilla Bugzilla 4.2.4 Mozilla Bugzilla 4.1.3 Mozilla Bugzilla 4.1.1 Mozilla Bugzilla 4.0.10 Mozilla Bugzilla 4.0.9 Mozilla Bugzilla 4.0.5 Mozilla Bugzilla 4.0.4 Mozilla Bugzilla 4.0.3 Mozilla Bugzilla 4.0.2 Mozilla Bugzilla 3.7.2 Mozilla Bugzilla 3.7.1 Mozilla Bugzilla 3.6.8 Mozilla Bugzilla 3.6.7 Mozilla Bugzilla 3.6.6 Mozilla Bugzilla 3.6.4 Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.5.3 Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.4.14 Mozilla Bugzilla 3.4.13 Mozilla Bugzilla 3.4.12 Mozilla Bugzilla 3.4.11 Mozilla Bugzilla 3.4.10 Mozilla Bugzilla 3.4.7 Mozilla Bugzilla 3.4.6 Mozilla Bugzilla 3.4.5 Mozilla Bugzilla 3.4.4 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.3.1 Mozilla Bugzilla 3.2.10 Mozilla Bugzilla 3.2.7 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.1.4 Mozilla Bugzilla 3.1.3 Mozilla Bugzilla 3.1.2 Mozilla Bugzilla 3.1.1 Mozilla Bugzilla 3.1 Mozilla Bugzilla 3.0.11 Mozilla Bugzilla 3.0.10 Mozilla Bugzilla 3.0.9 Mozilla Bugzilla 3.0.8 Mozilla Bugzilla 3.0.7 Mozilla Bugzilla 3.0.6 Mozilla Bugzilla 3.0.5 Mozilla Bugzilla 3.0.4 Mozilla Bugzilla 3.0.2 Mozilla Bugzilla 3.0.1 Mozilla Bugzilla 3.0 Mozilla Bugzilla 2.23.4 Mozilla Bugzilla 2.23.3 Mozilla Bugzilla 2.23.2 Mozilla Bugzilla 2.22.7 Mozilla Bugzilla 2.22.6 Mozilla Bugzilla 2.22.5 Mozilla Bugzilla 2.22.4 Mozilla Bugzilla 2.22.3 Mozilla Bugzilla 2.22.2 Mozilla Bugzilla 2.22.1 Mozilla Bugzilla 2.21.2 Mozilla Bugzilla 2.21.1 Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20.7 Mozilla Bugzilla 2.20.6 Mozilla Bugzilla 2.20.5 Mozilla Bugzilla 2.20.4 Mozilla Bugzilla 2.20.3 Mozilla Bugzilla 2.20.2 Mozilla Bugzilla 2.20.1 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.8 Mozilla Bugzilla 2.18.7 Mozilla Bugzilla 2.18.6 Mozilla Bugzilla 2.18.5 Mozilla Bugzilla 2.18.4 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.2 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.17 Mozilla Bugzilla 2.16.11 Mozilla Bugzilla 2.16.10 Mozilla Bugzilla 2.16.9 Mozilla Bugzilla 2.16.8 Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 .10 Mozilla Bugzilla 2.16 Mozilla Bugzilla 2.14.5 Mozilla Bugzilla 2.14.4 Mozilla Bugzilla 2.14.3 Mozilla Bugzilla 2.14.2 Mozilla Bugzilla 2.14.1 Mozilla Bugzilla 2.14 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.9 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 Mozilla Bugzilla 4.5.2 Mozilla Bugzilla 4.5.1 Mozilla Bugzilla 4.4.2 Mozilla Bugzilla 4.4.1 Mozilla Bugzilla 4.4 Rc2 Mozilla Bugzilla 4.4 Rc1 Mozilla Bugzilla 4.4 Mozilla Bugzilla 4.3.3 Mozilla Bugzilla 4.3.2 Mozilla Bugzilla 4.3.1 Mozilla Bugzilla 4.3 Mozilla Bugzilla 4.2rc2 Mozilla Bugzilla 4.2rc1 Mozilla Bugzilla 4.2.8 Mozilla Bugzilla 4.2.7 Mozilla Bugzilla 4.2.6 Mozilla Bugzilla 4.2.3 Mozilla Bugzilla 4.2.2 Mozilla Bugzilla 4.2.1 Mozilla Bugzilla 4.2 Rc2 Mozilla Bugzilla 4.2 Rc1 Mozilla Bugzilla 4.2 Mozilla Bugzilla 4.1.2 Mozilla Bugzilla 4.1 Mozilla Bugzilla 4.0rc2 Mozilla Bugzilla 4.0rc1 Mozilla Bugzilla 4.0.8 Mozilla Bugzilla 4.0.7 Mozilla Bugzilla 4.0.6 Mozilla Bugzilla 4.0.12 Mozilla Bugzilla 4.0.11 Mozilla Bugzilla 4.0.1 Mozilla Bugzilla 4.0 RC2 Mozilla Bugzilla 4.0 RC1 Mozilla Bugzilla 4.0 Mozilla Bugzilla 3.7.3 Mozilla Bugzilla 3.7.2 Mozilla Bugzilla 3.7 Mozilla Bugzilla 3.6rc1 Mozilla Bugzilla 3.6.9 Mozilla Bugzilla 3.6.5 Mozilla Bugzilla 3.6.3 Mozilla Bugzilla 3.6.2 Mozilla Bugzilla 3.6.13 Mozilla Bugzilla 3.6.12 Mozilla Bugzilla 3.6.11 Mozilla Bugzilla 3.6.10 Mozilla Bugzilla 3.6.0 Mozilla Bugzilla 3.6 Rc1 Mozilla Bugzilla 3.6 Mozilla Bugzilla 3.5 Mozilla Bugzilla 3.4.9 Mozilla Bugzilla 3.4.8 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.3 Mozilla Bugzilla 3.2rc2 Mozilla Bugzilla 3.2rc1 Mozilla Bugzilla 3.2.9 Mozilla Bugzilla 3.2.8 Mozilla Bugzilla 3.2 Mozilla Bugzilla 3.0.3 Mozilla Bugzilla 2.22 RC1 Mozilla Bugzilla 2.22 Mozilla Bugzilla 2.21.2 Rc1 Mozilla Bugzilla 2.20 Mozilla Bugzilla 2.18.9 Mozilla Bugzilla 2.18.6+ Mozilla Bugzilla 2.16 Rc2 Mozilla Bugzilla 2.0 |
| Not Vulnerable: |
Mozilla Bugzilla 4.5.3 Mozilla Bugzilla 4.4.3 |
Discussion
Bugzilla CVE-2014-1517 Cross Site Request Forgery Vulnerability
Bugzilla is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
Bugzilla versions 2.0 through 4.4.2 and 4.5.1 through 4.5.2 are vulnerable.
Bugzilla is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
Bugzilla versions 2.0 through 4.4.2 and 4.5.1 through 4.5.2 are vulnerable.
Exploit / POC
Bugzilla CVE-2014-1517 Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
Solution / Fix
Bugzilla CVE-2014-1517 Cross Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Bugzilla CVE-2014-1517 Cross Site Request Forgery Vulnerability
References:
References:
- (CVE-2014-1517) [SECURITY] Login form lacks CSRF protection (Bugzilla)
- Bugzilla Homepage (Bugzilla)
- 4.5.3, 4.4.3, 4.2.8, and 4.0.12 Security Advisory (Bugzilla)