CVE-2010-3172: Code Injection
CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote attackers to inject arbitrary HTTP headers and content, and conduct HTTP response splitting attacks, via a crafted URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3172?
CVE-2010-3172 is considered a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2010-3172?
To mitigate CVE-2010-3172, users should upgrade to Bugzilla version 3.2.9 or later, 3.4.9 or later, 3.6.3 or later, or 4.0rc1 or later.
What type of attacks can CVE-2010-3172 facilitate?
CVE-2010-3172 can facilitate HTTP response splitting attacks by allowing attackers to inject arbitrary HTTP headers and content.
Which versions of Bugzilla are affected by CVE-2010-3172?
CVE-2010-3172 affects Bugzilla versions before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1.
What is CRLF injection as related to CVE-2010-3172?
CRLF injection in CVE-2010-3172 refers to the injection of carriage return and line feed characters into an HTTP request, leading to header manipulation.