CVE-2009-0482: CSRF

Published Feb 9, 2009

Updated

Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to processbug.cgi.

Affected Software

76 affected components

Bugzilla=3.0.4

Bugzilla=2.16.8

Bugzilla=3.0.0

Bugzilla=2.16_rc2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.16.9

Bugzilla=3.0.6

Bugzilla=2.20.1

Bugzilla=2.14.2

Bugzilla=2.18.7

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=2.14.4

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.2

Bugzilla=2.18.4

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.16.6

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.0.5

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=2.16.5

Bugzilla=3.3.1

Bugzilla=2.14

Bugzilla=2.19.2

Bugzilla=2.16.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 3.2.1
Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 3.3.2

Event History

Feb 9, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0482?

CVE-2009-0482 has been classified as a moderate severity vulnerability.

How do I fix CVE-2009-0482?

To fix CVE-2009-0482, upgrade Bugzilla to version 3.2.1 or later.

What type of vulnerability is CVE-2009-0482?

CVE-2009-0482 is a Cross-site request forgery (CSRF) vulnerability.

Which versions of Bugzilla are affected by CVE-2009-0482?

Versions of Bugzilla prior to 3.2.1 and 3.3.2 are affected by CVE-2009-0482.

What can attackers achieve with CVE-2009-0482?

Attackers can perform bug updating activities as other users through a crafted link or IMG tag.