CVE-2012-0466: XSS

Published Apr 27, 2012

Updated

template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins, which allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive bug information via a crafted web page.

Affected Software

164 affected components

Bugzilla=2.0

Bugzilla=2.2

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.9

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16-rc1

Bugzilla=2.16-rc2

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.16.6

Bugzilla=2.16.7

Bugzilla=2.16.8

Bugzilla=2.16.9

Bugzilla=2.16.10

Bugzilla=2.16.11

Bugzilla=2.17

Bugzilla=2.17.1

Bugzilla=2.17.2

Bugzilla=2.17.3

Bugzilla=2.17.4

Bugzilla=2.17.5

Bugzilla=2.17.6

Bugzilla=2.17.7

Bugzilla=2.18

Bugzilla=2.18-rc1

Bugzilla=2.18-rc2

Bugzilla=2.18-rc3

Bugzilla=2.18.1

Bugzilla=2.18.2

Bugzilla=2.18.3

Bugzilla=2.18.4

Bugzilla=2.18.5

Bugzilla=2.18.6

Bugzilla=2.18.6\+

Bugzilla=2.18.7

Bugzilla=2.18.8

Bugzilla=2.18.9

Bugzilla=2.19

Bugzilla=2.19.1

Bugzilla=2.19.2

Bugzilla=2.19.3

Bugzilla=2.20

Bugzilla=2.20-rc1

Bugzilla=2.20-rc2

Bugzilla=2.20.1

Bugzilla=2.20.2

Bugzilla=2.20.3

Bugzilla=2.20.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.20.7

Bugzilla=2.21

Bugzilla=2.21.1

Bugzilla=2.21.2

Bugzilla=2.21.2-rc1

Bugzilla=2.22

Bugzilla=2.22-rc1

Bugzilla=2.22.1

Bugzilla=2.22.2

Bugzilla=2.22.3

Bugzilla=2.22.4

Bugzilla=2.22.5

Bugzilla=2.22.6

Bugzilla=2.22.7

Bugzilla=2.23

Bugzilla=2.23.1

Bugzilla=2.23.2

Bugzilla=2.23.3

Bugzilla=2.23.4

Bugzilla=3.0

Bugzilla=3.0-rc1

Bugzilla=3.0.0

Bugzilla=3.0.1

Bugzilla=3.0.2

Bugzilla=3.0.3

Bugzilla=3.0.4

Bugzilla=3.0.5

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.8

Bugzilla=3.0.9

Bugzilla=3.0.10

Bugzilla=3.0.11

Bugzilla=3.1.0

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.1.3

Bugzilla=3.1.4

Bugzilla=3.2

Bugzilla=3.2-rc1

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.2.2

Bugzilla=3.2.3

Bugzilla=3.2.4

Bugzilla=3.2.5

Bugzilla=3.2.6

Bugzilla=3.2.7

Bugzilla=3.2.8

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.3

Bugzilla=3.3.1

Bugzilla=3.3.2

Bugzilla=3.3.3

Bugzilla=3.3.4

Bugzilla=3.4

Bugzilla=3.4-rc1

Bugzilla=3.4.1

Bugzilla=3.4.2

Bugzilla=3.4.3

Bugzilla=3.4.4

Bugzilla=3.4.5

Bugzilla=3.4.6

Bugzilla=3.4.7

Bugzilla=3.4.8

Bugzilla=3.4.9

Bugzilla=3.4.10

Bugzilla=3.4.11

Bugzilla=3.4.12

Bugzilla=3.4.13

Bugzilla=3.5

Bugzilla=3.5.1

Bugzilla=3.5.2

Bugzilla=3.5.3

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.0

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.7

Bugzilla=3.7.1

Bugzilla=3.7.2

Bugzilla=3.7.3

Bugzilla=4.0.1

Bugzilla=4.0.2

Bugzilla=4.0.3

Bugzilla=4.0.4

Bugzilla=4.0.5

Bugzilla=4.1.1

Bugzilla=4.1.2

Bugzilla=4.1.3

Bugzilla=4.2

Bugzilla=4.2-rc1

Bugzilla=4.2-rc2

Event History

Apr 27, 2012

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0466?

CVE-2012-0466 has been classified as a medium severity vulnerability.

How do I fix CVE-2012-0466?

To mitigate CVE-2012-0466, upgrade Bugzilla to version 3.6.9 or later.

What type of vulnerability is CVE-2012-0466?

CVE-2012-0466 is a cross-site scripting (XSS) vulnerability.

Who is affected by CVE-2012-0466?

Bugzilla versions 2.x and 3.x before 3.6.9, and various 4.x versions prior to 4.2.1 are affected by CVE-2012-0466.

What attack vectors are possible with CVE-2012-0466?

CVE-2012-0466 allows remote attackers to conduct cross-site scripting (XSS) attacks, which can potentially expose sensitive bug information.

CVE-2012-0466: XSS

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2012-0466?

How do I fix CVE-2012-0466?

What type of vulnerability is CVE-2012-0466?

Who is affected by CVE-2012-0466?

What attack vectors are possible with CVE-2012-0466?

Company

Resources

Contact