CVE-2012-5883: XSS
Bugzilla is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Flash component infrastructure in YUI script. A remote attacker could exploit this vulnerability using attack vectors related to swfstore.swf to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2012-5883?
CVE-2012-5883 is a cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI versions 2.8.0 through 2.9.0 and Bugzilla versions 3.7 through 4.3.3.
How does the CVE-2012-5883 vulnerability work?
The CVE-2012-5883 vulnerability allows a remote attacker to execute malicious scripts in a victim's web browser by exploiting the improper validation of user-supplied input by the Flash component infrastructure in YUI and Bugzilla.
Which software versions are affected by CVE-2012-5883?
CVE-2012-5883 affects YUI versions 2.8.0 through 2.9.0 and Bugzilla versions 3.7 through 4.3.3.
What is the severity of CVE-2012-5883?
CVE-2012-5883 has a severity rating of 4.3 (Medium).
How can I fix the CVE-2012-5883 vulnerability?
To fix the CVE-2012-5883 vulnerability, it is recommended to update YUI to a version higher than 2.9.0 and Bugzilla to a version higher than 4.3.3.