CVE-2009-1213: CSRF

Published Apr 1, 2009

Updated

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.

Affected Software

9 affected components

Bugzilla=3.3.2

Bugzilla=3.2-rc1

Bugzilla=3.2

Bugzilla=3.3.3

Bugzilla=3.2.2

Bugzilla=3.3

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 3.2.3
Upgrade
Upgrade Bugzilla to a version that resolves this vulnerability.
Fixed in 3.3.4

Event History

Apr 1, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·10:30 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-1213?

CVE-2009-1213 is classified as a medium severity vulnerability due to its potential for exploitation via cross-site request forgery.

How do I fix CVE-2009-1213?

To fix CVE-2009-1213, upgrade Bugzilla to version 3.2.3 or later, or 3.3.4 or later.

What types of systems are affected by CVE-2009-1213?

CVE-2009-1213 affects Bugzilla versions 3.2, 3.3, and their corresponding release candidates.

Can CVE-2009-1213 be exploited remotely?

Yes, CVE-2009-1213 can be exploited remotely by attackers to hijack user authentication.

What is the nature of the vulnerability in CVE-2009-1213?

CVE-2009-1213 is a cross-site request forgery (CSRF) vulnerability affecting attachment handling in Bugzilla.