CVE-2009-0483: CSRF

Published Feb 9, 2009

Updated

Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi.

Affected Software

76 affected components

Bugzilla=3.0.4

Bugzilla=2.16.8

Bugzilla=3.0.0

Bugzilla=2.16_rc2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.16.9

Bugzilla=3.0.6

Bugzilla=2.20.1

Bugzilla=2.14.2

Bugzilla=2.18.7

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=2.14.4

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.2

Bugzilla=2.18.4

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.16.6

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.0.5

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=2.16.5

Bugzilla=3.3.1

Bugzilla=2.14

Bugzilla=2.19.2

Bugzilla=2.16.10

Event History

Feb 9, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0483?

CVE-2009-0483 has a moderate severity rating as it allows attackers to perform actions without user consent.

How do I fix CVE-2009-0483?

To fix CVE-2009-0483, users should upgrade Bugzilla to version 2.22.7 or later.

What kind of attacks does CVE-2009-0483 enable?

CVE-2009-0483 enables cross-site request forgery (CSRF) attacks that can lead to unauthorized changes to user preferences.

Which versions of Bugzilla are affected by CVE-2009-0483?

CVE-2009-0483 affects Bugzilla versions prior to 2.22.7, including versions 2.22, 2.20, and 3.0 up to 3.3.1.

Is there a workaround for CVE-2009-0483 if I cannot upgrade?

A temporary workaround for CVE-2009-0483 is to implement CSRF protection methods, but upgrading is the recommended solution.