CVE-2009-3165: SQL Injection
First published: Tue Sep 15 2009(Updated: )
SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =3.0.4 | |
| Mozilla Bugzilla | =3.0-rc1 | |
| Mozilla Bugzilla | =3.1.3 | |
| Mozilla Bugzilla | =3.3.2 | |
| Mozilla Bugzilla | =3.0.1 | |
| Mozilla Bugzilla | =3.2-rc1 | |
| Mozilla Bugzilla | =3.1.1 | |
| Mozilla Bugzilla | =3.1.2 | |
| Mozilla Bugzilla | =3.3.4 | |
| Mozilla Bugzilla | =3.2.3 | |
| Mozilla Bugzilla | =2.23.4 | |
| Mozilla Bugzilla | =3.0 | |
| Mozilla Bugzilla | =3.0.6 | |
| Mozilla Bugzilla | =3.0.7 | |
| Mozilla Bugzilla | =3.4.1 | |
| Mozilla Bugzilla | =3.1.4 | |
| Mozilla Bugzilla | =3.0.3 | |
| Mozilla Bugzilla | =3.2 | |
| Mozilla Bugzilla | =3.2.4 | |
| Mozilla Bugzilla | =3.0.2 | |
| Mozilla Bugzilla | =3.3.3 | |
| Mozilla Bugzilla | =3.2.2 | |
| Mozilla Bugzilla | =3.4 | |
| Mozilla Bugzilla | =3.0.8 | |
| Mozilla Bugzilla | =3.2-rc2 | |
| Mozilla Bugzilla | =3.4-rc1 | |
| Mozilla Bugzilla | =3.0.5 | |
| Mozilla Bugzilla | =3.2.1 | |
| Mozilla Bugzilla | =3.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-3165?
CVE-2009-3165 has been classified as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2009-3165?
To fix CVE-2009-3165, upgrade Bugzilla to version 3.4.2 or later, which addresses this SQL injection vulnerability.
What systems are affected by CVE-2009-3165?
CVE-2009-3165 affects Bugzilla versions from 2.23.4 up to 3.4.1.
What type of vulnerability is CVE-2009-3165?
CVE-2009-3165 is an SQL injection vulnerability that can be exploited through the Bug.create WebService function.
Can CVE-2009-3165 lead to data breaches?
Yes, CVE-2009-3165 can lead to data breaches as it allows attackers to manipulate and extract sensitive information from the database.
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/event
- agent/source
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/3.0.4
- version/mozilla bugzilla/3.0-rc1
- version/mozilla bugzilla/3.1.3
- version/mozilla bugzilla/3.3.2
- version/mozilla bugzilla/3.0.1
- version/mozilla bugzilla/3.2-rc1
- version/mozilla bugzilla/3.1.1
- version/mozilla bugzilla/3.1.2
- version/mozilla bugzilla/3.3.4
- version/mozilla bugzilla/3.2.3
- version/mozilla bugzilla/2.23.4
- version/mozilla bugzilla/3.0
- version/mozilla bugzilla/3.0.6
- version/mozilla bugzilla/3.0.7
- version/mozilla bugzilla/3.4.1
- version/mozilla bugzilla/3.1.4
- version/mozilla bugzilla/3.0.3
- version/mozilla bugzilla/3.2
- version/mozilla bugzilla/3.2.4
- version/mozilla bugzilla/3.0.2
- version/mozilla bugzilla/3.3.3
- version/mozilla bugzilla/3.2.2
- version/mozilla bugzilla/3.4
- version/mozilla bugzilla/3.0.8
- version/mozilla bugzilla/3.2-rc2
- version/mozilla bugzilla/3.4-rc1
- version/mozilla bugzilla/3.0.5
- version/mozilla bugzilla/3.2.1
- version/mozilla bugzilla/3.3.1