CVE-2011-3668: CSRF
Published Jan 2, 2012
·Updated
Cross-site request forgery (CSRF) vulnerability in postbug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports.
Affected Software
161 affected components
Bugzilla=2.0
Bugzilla=2.18.6\+
Bugzilla=2.16.8
Bugzilla=2.22.7
Bugzilla=2.16_rc2
Bugzilla=2.18.8
Bugzilla=2.17.6
Bugzilla=2.16-rc2
Bugzilla=2.18.5
Bugzilla=2.19.3
Bugzilla=2.20-rc2
Bugzilla=2.18.6
Bugzilla=2.17.2
Bugzilla=2.20-rc1
Bugzilla=2.16.1
Bugzilla=2.20
Bugzilla=2.19
Bugzilla=2.18-rc1
Bugzilla=2.16.2
Bugzilla=2.16.11
Bugzilla=2.20.5
Bugzilla=2.20.6
Bugzilla=2.22.3
Bugzilla=2.22.6
Bugzilla=2.17.4
Bugzilla=2.16-rc1
Bugzilla=2.23.2
Bugzilla=2.21.2
Bugzilla=2.10
Bugzilla=2.17.1
Bugzilla=2.16
Bugzilla=2.22.1
Bugzilla=2.23.4
Bugzilla=2.16.9
Bugzilla=2.20.1
Bugzilla=2.23.3
Bugzilla=2.14.2
Bugzilla=2.18.7
Bugzilla=2.23.1
Bugzilla=2.22.2
Bugzilla=2.18.1
Bugzilla=2.22-rc1
Bugzilla=2.14.3
Bugzilla=2.22.5
Bugzilla=2.14.4
Bugzilla=2.19.1
Bugzilla=2.16.7
Bugzilla=2.6
Bugzilla=2.17.5
Bugzilla=2.22
Bugzilla=2.17.3
Bugzilla=2.4
Bugzilla=2.16.4
Bugzilla=2.12
Bugzilla=2.21.2-rc1
Bugzilla=2.20.3
Bugzilla=2.8
Bugzilla=2.2
Bugzilla=2.18.4
Bugzilla=2.16.3
Bugzilla=2.14.5
Bugzilla=2.18.9
Bugzilla=2.18
Bugzilla=2.18.3
Bugzilla=2.17.7
Bugzilla=2.20.7
Bugzilla=2.20.2
Bugzilla=2.20.4
Bugzilla=2.21.1
Bugzilla=2.18-rc3
Bugzilla=2.17
Bugzilla=2.23
Bugzilla=2.16.6
Bugzilla=2.9
Bugzilla=2.18.2
Bugzilla=2.18-rc2
Bugzilla=2.14.1
Bugzilla=2.22.4
Bugzilla=2.21
Bugzilla=2.16.5
Bugzilla=2.14
Bugzilla=2.19.2
Bugzilla=2.16.10
Bugzilla=3.0.4
Bugzilla=3.0-rc1
Bugzilla=4.1.1
Bugzilla=3.1.3
Bugzilla=3.0.0
Bugzilla=3.7.2
Bugzilla=3.4.3
Bugzilla=3.3.2
Bugzilla=3.0.1
Bugzilla=3.2-rc1
Bugzilla=3.6.1
Bugzilla=3.2.6
Bugzilla=3.1.1
Bugzilla=3.7.1
Bugzilla=3.7
Bugzilla=3.6.0
Bugzilla=3.4.2
Bugzilla=3.1.2
Bugzilla=3.5.3
Bugzilla=3.6.3
Bugzilla=3.2.5
Bugzilla=3.3.4
Bugzilla=4.0.1
Bugzilla=3.6
Bugzilla=4.0-rc2
Bugzilla=3.6.4
Bugzilla=3.2.9
Bugzilla=3.2.10
Bugzilla=4.1
Bugzilla=3.2.3
Bugzilla=4.0.2
Bugzilla=3.5.2
Bugzilla=3.4.9
Bugzilla=3.0
Bugzilla=3.5.1
Bugzilla=3.0.11
Bugzilla=3.0.6
Bugzilla=3.5
Bugzilla=3.0.7
Bugzilla=3.2.8
Bugzilla=3.4.1
Bugzilla=3.4.10
Bugzilla=3.4.4
Bugzilla=3.6-rc1
Bugzilla=3.4.8
Bugzilla=3.4.7
Bugzilla=3.1.4
Bugzilla=4.1.2
Bugzilla=3.1.0
Bugzilla=3.6.7
Bugzilla=3.0.3
Bugzilla=3.2
Bugzilla=3.0.9
Bugzilla=3.4.11
Bugzilla=3.2.4
Bugzilla=3.0.2
Bugzilla=3.7.3
Bugzilla=3.3.3
Bugzilla=3.2.2
Bugzilla=3.6.6
Bugzilla=3.3
Bugzilla=3.4.12
Bugzilla=3.0.10
Bugzilla=3.4
Bugzilla=4.0-rc1
Bugzilla=3.0.8
Bugzilla=3.2.7
Bugzilla=3.4.5
Bugzilla=3.2-rc2
Bugzilla=3.6.5
Bugzilla=3.4-rc1
Bugzilla=3.0.5
Bugzilla=4.1.3
Bugzilla=3.2.1
Bugzilla=3.3.1
Bugzilla=3.4.6
Bugzilla=3.6.2
Bugzilla=4.0
Event History
Jan 2, 2012
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3668?
The severity of CVE-2011-3668 is classified as high due to its potential for cross-site request forgery attacks.
2
How do I fix CVE-2011-3668?
To fix CVE-2011-3668, upgrade to Bugzilla version 4.2rc1 or later, which includes the necessary security patches.
3
What type of vulnerability is CVE-2011-3668?
CVE-2011-3668 is a cross-site request forgery (CSRF) vulnerability affecting Bugzilla.
4
Which versions of Bugzilla are affected by CVE-2011-3668?
CVE-2011-3668 affects Bugzilla versions 2.x, 3.x, and 4.x prior to 4.2rc1.
5
What can happen if CVE-2011-3668 is exploited?
If exploited, CVE-2011-3668 can allow remote attackers to hijack authentication and create bug reports on behalf of arbitrary users.