CVE-2009-1213: CSRF
First published: Wed Apr 01 2009(Updated: )
Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =3.3.2 | |
| Mozilla Bugzilla | =3.2-rc1 | |
| Mozilla Bugzilla | =3.2 | |
| Mozilla Bugzilla | =3.3.3 | |
| Mozilla Bugzilla | =3.2.2 | |
| Mozilla Bugzilla | =3.3 | |
| Mozilla Bugzilla | =3.2-rc2 | |
| Mozilla Bugzilla | =3.2.1 | |
| Mozilla Bugzilla | =3.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.bugzilla.org/security/3.2.2/
- http://secunia.com/advisories/34545
- http://www.vupen.com/english/advisories/2009/0887
- http://secunia.com/advisories/34547
- http://www.securityfocus.com/bid/34308
- https://bugzilla.mozilla.org/show_bug.cgi?id=476603
- https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html
- https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html
- http://secunia.com/advisories/34624
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49524
Frequently Asked Questions
What is the severity of CVE-2009-1213?
CVE-2009-1213 is classified as a medium severity vulnerability due to its potential for exploitation via cross-site request forgery.
How do I fix CVE-2009-1213?
To fix CVE-2009-1213, upgrade Bugzilla to version 3.2.3 or later, or 3.3.4 or later.
What types of systems are affected by CVE-2009-1213?
CVE-2009-1213 affects Bugzilla versions 3.2, 3.3, and their corresponding release candidates.
Can CVE-2009-1213 be exploited remotely?
Yes, CVE-2009-1213 can be exploited remotely by attackers to hijack user authentication.
What is the nature of the vulnerability in CVE-2009-1213?
CVE-2009-1213 is a cross-site request forgery (CSRF) vulnerability affecting attachment handling in Bugzilla.
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/3.3.2
- version/mozilla bugzilla/3.2-rc1
- version/mozilla bugzilla/3.2
- version/mozilla bugzilla/3.3.3
- version/mozilla bugzilla/3.2.2
- version/mozilla bugzilla/3.3
- version/mozilla bugzilla/3.2-rc2
- version/mozilla bugzilla/3.2.1
- version/mozilla bugzilla/3.3.1