CVE-2011-2976: XSS

Published Aug 9, 2011

Updated

Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving a BUGLIST cookie.

Affected Software

106 affected components

Bugzilla=2.16.8

Bugzilla=2.22.7

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.21.2

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.16.9

Bugzilla=2.20.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.22.5

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.16.4

Bugzilla=2.20.3

Bugzilla=2.18.4

Bugzilla=2.16.3

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.16.6

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=2.16.5

Bugzilla=2.19.2

Bugzilla=2.16.10

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=3.1.3

Bugzilla=3.0.0

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=3.2-rc1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.2.3

Bugzilla=3.0

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.2.8

Bugzilla=3.1.4

Bugzilla=3.1.0

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=3.0.9

Bugzilla=3.2.4

Bugzilla=3.0.2

Bugzilla=3.3.3

Bugzilla=3.2.2

Bugzilla=3.3

Bugzilla=3.0.10

Bugzilla=3.0.8

Bugzilla=3.2.7

Bugzilla=3.2-rc2

Bugzilla=3.0.5

Bugzilla=3.2.1

Bugzilla=3.3.1

Bugzilla=3.4.3

Bugzilla=3.4.2

Bugzilla=3.4.9

Bugzilla=3.4.1

Bugzilla=3.4.10

Bugzilla=3.4.4

Bugzilla=3.4.8

Bugzilla=3.4.7

Bugzilla=3.4.11

Bugzilla=3.4

Bugzilla=3.4.5

Bugzilla=3.4-rc1

Bugzilla=3.4.6

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=660053

Event History

Aug 9, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2976?

CVE-2011-2976 has a medium severity rating due to its potential for creating cross-site scripting vulnerabilities.

How do I fix CVE-2011-2976?

To fix CVE-2011-2976, update Bugzilla to version 3.4.12 or later, which addresses this vulnerability.

What versions of Bugzilla are affected by CVE-2011-2976?

CVE-2011-2976 affects Bugzilla versions from 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and before 3.4.12.

What type of vulnerability is CVE-2011-2976?

CVE-2011-2976 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts or HTML.

Can CVE-2011-2976 be exploited remotely?

Yes, CVE-2011-2976 can be exploited remotely, allowing attackers to execute malicious scripts in the context of the victim's browser.