CVE-2011-3657

Related Files

Bugzilla Chart Generator Cross Site Scripting

Posted Jan 3, 2012

Site redteam-pentesting.de

RedTeam Pentesting discovered a cross site scripting vulnerability in Bugzilla's chart generator during a penetration test. If attackers can persuade users to click on a prepared link or redirected them to such a link from an attacker-controlled website, they are able to run arbitrary JavaScript code in the context of the Bugzilla installation's domain. Versions affected include 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3.

tags | exploit, arbitrary, javascript, xss

advisories | CVE-2011-3657

SHA-256 | ca81bb38b09a55cb4defe19fe6466a61b7037842c123590640a2365869115e44

Download | Favorite | View

Bugzilla XSS / XSRF / Unauthorized Account Creation

Posted Dec 29, 2011

Site bugzilla.org

Bugzilla versions 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site scripting vulnerability. Versions 2.23.3 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from an unauthorized account creation vulnerability. Versions 2.0 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site request forgery vulnerability.

tags | advisory, xss, csrf

advisories | CVE-2011-3657, CVE-2011-3667

SHA-256 | d7fe9cc19e92befb40189c8947a6c9db762e9a8c444631d574538ff2387c7051

Download | Favorite | View