CVE-2010-4570: XSS
First published: Fri Jan 28 2011(Updated: )
Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the summary field, related to the DataTable widget in YUI.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =3.7.2 | |
| Mozilla Bugzilla | =3.7.1 | |
| Mozilla Bugzilla | =3.7.3 | |
| Mozilla Bugzilla | =4.0-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://yuilibrary.com/forum/viewtopic.php?p=12923
- https://bugzilla.mozilla.org/show_bug.cgi?id=619648
- http://www.vupen.com/english/advisories/2011/0207
- http://www.bugzilla.org/security/3.2.9/
- http://yuilibrary.com/projects/yui2/ticket/2529228
- http://www.securityfocus.com/bid/45982
- http://osvdb.org/70702
- http://www.vupen.com/english/advisories/2011/0271
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65179
Frequently Asked Questions
What is the severity of CVE-2010-4570?
CVE-2010-4570 is rated as a medium severity vulnerability due to its potential for permitting cross-site scripting (XSS) attacks.
How do I fix CVE-2010-4570?
To fix CVE-2010-4570, upgrade Bugzilla to a version that addresses the vulnerability, such as Bugzilla 4.0 and later.
Which versions of Bugzilla are affected by CVE-2010-4570?
CVE-2010-4570 affects Bugzilla versions 3.7.1, 3.7.2, 3.7.3, and 4.0rc1.
What type of vulnerability is CVE-2010-4570?
CVE-2010-4570 is a cross-site scripting (XSS) vulnerability.
Can CVE-2010-4570 lead to data theft?
Yes, CVE-2010-4570 can potentially lead to data theft by allowing attackers to inject malicious scripts into web pages.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-historical
- collector/nvd-index
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/3.7.2
- version/mozilla bugzilla/3.7.1
- version/mozilla bugzilla/3.7.3
- version/mozilla bugzilla/4.0-rc1