CVE-2011-3657: XSS

Published Jan 2, 2012

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when debug mode is used, allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) tabular report, (2) graphical report, or (3) new chart.

Affected Software

160 affected components

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=4.1.1

Bugzilla=3.1.3

Bugzilla=2.0

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=3.0.0

Bugzilla=2.22.7

Bugzilla=3.7.2

Bugzilla=3.4.3

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=3.2-rc1

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.7.1

Bugzilla=3.7

Bugzilla=3.6.0

Bugzilla=3.4.2

Bugzilla=2.16.2

Bugzilla=3.1.2

Bugzilla=3.5.3

Bugzilla=2.16.11

Bugzilla=3.6.3

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=4.0.1

Bugzilla=2.22.3

Bugzilla=3.6

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=4.0-rc2

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=3.6.4

Bugzilla=3.2.9

Bugzilla=2.10

Bugzilla=3.2.10

Bugzilla=4.1

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=4.0.2

Bugzilla=2.23.4

Bugzilla=3.5.2

Bugzilla=2.16.9

Bugzilla=3.4.9

Bugzilla=3.0

Bugzilla=3.5.1

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=3.5

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=3.0.7

Bugzilla=3.2.8

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=3.4.1

Bugzilla=3.4.10

Bugzilla=3.4.4

Bugzilla=3.6-rc1

Bugzilla=2.14.4

Bugzilla=3.4.8

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=3.1.4

Bugzilla=2.17.5

Bugzilla=4.1.2

Bugzilla=2.22

Bugzilla=3.1.0

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=3.6.7

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=2.21.2-rc1

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.9

Bugzilla=3.4.11

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=3.0.2

Bugzilla=3.7.3

Bugzilla=3.3.3

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.16.3

Bugzilla=3.6.6

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=3.3

Bugzilla=2.18

Bugzilla=3.4.12

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=3.0.10

Bugzilla=2.20.7

Bugzilla=3.4

Bugzilla=4.0-rc1

Bugzilla=3.0.8

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.4.5

Bugzilla=3.2-rc2

Bugzilla=3.6.5

Bugzilla=3.4-rc1

Bugzilla=3.0.5

Bugzilla=4.1.3

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=2.16.5

Bugzilla=3.3.1

Bugzilla=3.4.6

Bugzilla=3.6.2

Bugzilla=2.14

Bugzilla=4.0

Bugzilla=2.19.2

Bugzilla=2.16.10

Event History

Jan 2, 2012

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-3657?

CVE-2011-3657 is considered to be of moderate severity due to its potential for cross-site scripting attacks.

How do I fix CVE-2011-3657?

To fix CVE-2011-3657, upgrade to Bugzilla version 3.4.13, 3.6.7, or later versions as specified in the vulnerability report.

What are the affected versions for CVE-2011-3657?

CVE-2011-3657 affects Bugzilla versions 2.x and 3.x, specifically versions before 3.4.13, 3.6.7, and those versions in the 3.5.x and 4.x series before 4.0.3 and 4.1.4.

What happens if I don't patch CVE-2011-3657?

If CVE-2011-3657 is not patched, attackers may exploit the XSS vulnerabilities to inject malicious scripts, which could compromise user data or sessions.

Is CVE-2011-3657 easy to exploit?

Exploitation of CVE-2011-3657 is considered to be relatively easy for attackers with basic skills due to the nature of cross-site scripting vulnerabilities.