CVE-2008-6098: Medium severity Bugzilla vulnerability

Published Feb 9, 2009

Updated

Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to "approve."

Affected Software

64 affected components

Bugzilla=3.0.4

Bugzilla=3.1.3

Bugzilla=3.0.0

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.20-rc1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=3.0.6

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=3.0.7

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.22.5

Bugzilla=2.19.1

Bugzilla=3.1.4

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=3.1.0

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.2

Bugzilla=2.18.4

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.23

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.0.5

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=3.3.1

Bugzilla=3.0_rc1

Bugzilla=2.19.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 3.2 RC2
Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 3.0.6
Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 2.22.6
Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 2.20.7

Event History

Feb 9, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-6098?

The severity of CVE-2008-6098 is typically classified as medium, as it allows authenticated users to bypass moderation controls.

How do I fix CVE-2008-6098?

To fix CVE-2008-6098, update Bugzilla to version 3.2 RC2 or later for version 3.2, 3.0.6 for version 3.0, or appropriate fixes for other affected versions.

Who is affected by CVE-2008-6098?

CVE-2008-6098 affects Bugzilla versions prior to 3.2 RC2, including various versions of 3.0, 2.22, and earlier.

What type of vulnerability is CVE-2008-6098?

CVE-2008-6098 is a moderation bypass vulnerability that affects how quips are approved or disapproved in Bugzilla.

Is the exploitation of CVE-2008-6098 common?

While the exploit requires authenticated access, if exploited, it can lead to unauthorized approvals, making it a potential risk in environments with multiple users.