CVE-2011-0048: XSS

Q: What is the severity of CVE-2011-0048?

CVE-2011-0048 is classified as a moderate severity vulnerability that allows for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2011-0048?

To mitigate CVE-2011-0048, upgrade to Bugzilla version 3.2.10, 3.4.10, 3.6.4, or 4.0rc2 or later.

Q: What types of attacks are enabled by CVE-2011-0048?

CVE-2011-0048 allows attackers to conduct cross-site scripting (XSS) attacks against logged-out users.

Q: Which versions of Bugzilla are vulnerable to CVE-2011-0048?

Bugzilla versions before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 are vulnerable.

Q: Who is affected by the vulnerability identified as CVE-2011-0048?

Users of vulnerable Bugzilla versions, especially those who are logged out, are at risk of XSS attacks.

Published Jan 28, 2011

Updated

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bugfileloc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Affected Software

109 affected components

Bugzilla=2.0

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=2.22.7

Bugzilla=3.4.3

Bugzilla=2.16_rc2

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=3.2-rc1

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.6.0

Bugzilla=3.4.2

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=3.6.3

Bugzilla=3.2.5

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=2.16.9

Bugzilla=3.4.9

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=3.2.8

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=2.14.4

Bugzilla=3.4.8

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=4.0-rc1

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla<=3.2.9

Bugzilla=2.17

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.4.5

Bugzilla=3.2-rc2

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=2.16.5

Bugzilla=3.4.6

Bugzilla=3.6.2

Bugzilla=2.14

Bugzilla=4.0

Bugzilla=2.19.2

Bugzilla=2.16.10

Event History

Jan 28, 2011

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-0048?

CVE-2011-0048 is classified as a moderate severity vulnerability that allows for cross-site scripting (XSS) attacks.

How do I fix CVE-2011-0048?

To mitigate CVE-2011-0048, upgrade to Bugzilla version 3.2.10, 3.4.10, 3.6.4, or 4.0rc2 or later.

What types of attacks are enabled by CVE-2011-0048?

CVE-2011-0048 allows attackers to conduct cross-site scripting (XSS) attacks against logged-out users.

Which versions of Bugzilla are vulnerable to CVE-2011-0048?

Bugzilla versions before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 are vulnerable.

Who is affected by the vulnerability identified as CVE-2011-0048?