CVE-2010-4567: XSS

Q: What is the severity of CVE-2010-4567?

The severity of CVE-2010-4567 is rated as critical because it allows remote attackers to conduct cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2010-4567?

To fix CVE-2010-4567, update Bugzilla to versions 3.2.10, 3.4.10, 3.6.4, or 4.0rc2 or later.

Q: What versions of Bugzilla are affected by CVE-2010-4567?

CVE-2010-4567 affects Bugzilla versions before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2.

Q: What type of vulnerability is CVE-2010-4567?

CVE-2010-4567 is a cross-site scripting (XSS) vulnerability.

Q: Can CVE-2010-4567 be exploited by unauthenticated users?

Yes, CVE-2010-4567 can be exploited by unauthenticated remote attackers.

Published Jan 28, 2011

Updated

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bugfileloc) field.

Affected Software

109 affected components

Bugzilla=2.0

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=2.22.7

Bugzilla=3.4.3

Bugzilla=2.16_rc2

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=3.2-rc1

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.6.0

Bugzilla=3.4.2

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=3.6.3

Bugzilla=3.2.5

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=2.16.9

Bugzilla=3.4.9

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=3.2.8

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=2.14.4

Bugzilla=3.4.8

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=4.0-rc1

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla<=3.2.9

Bugzilla=2.17

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.4.5

Bugzilla=3.2-rc2

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=2.16.5

Bugzilla=3.4.6

Bugzilla=3.6.2

Bugzilla=2.14

Bugzilla=4.0

Bugzilla=2.19.2

Bugzilla=2.16.10

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=619588

Event History

Jan 28, 2011

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4567?

The severity of CVE-2010-4567 is rated as critical because it allows remote attackers to conduct cross-site scripting (XSS) attacks.

How do I fix CVE-2010-4567?