CVE-2013-0785: XSS

Q: What is the severity of CVE-2013-0785?

CVE-2013-0785 is classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2013-0785?

To fix CVE-2013-0785, upgrade Bugzilla to version 3.6.13, 4.0.10, 4.2.5, or later.

Q: What versions of Bugzilla are affected by CVE-2013-0785?

CVE-2013-0785 affects Bugzilla versions prior to 3.6.13, 4.0.10, 4.2.5, and several 4.x versions listed in the advisory.

Q: Can CVE-2013-0785 be exploited remotely?

Yes, CVE-2013-0785 can be exploited remotely by attackers to inject malicious scripts through the ID parameter.

Q: Is CVE-2013-0785 related to any other vulnerabilities?

CVE-2013-0785 is a standalone XSS vulnerability but may have implications in conjunction with other vulnerabilities affecting web applications.

Published Feb 24, 2013

Updated

Cross-site scripting (XSS) vulnerability in showbug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter.

Affected Software

47 affected components

Bugzilla<=3.6.12

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.0

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.6.9

Bugzilla=3.6.10

Bugzilla=3.6.11

Bugzilla=3.7

Bugzilla=3.7.1

Bugzilla=3.7.2

Bugzilla=3.7.3

Bugzilla=4.0

Bugzilla=4.0-rc1

Bugzilla=4.0-rc2

Bugzilla=4.0.1

Bugzilla=4.0.2

Bugzilla=4.0.3

Bugzilla=4.0.4

Bugzilla=4.0.5

Bugzilla=4.0.6

Bugzilla=4.0.7

Bugzilla=4.0.8

Bugzilla=4.0.9

Bugzilla=4.1

Bugzilla=4.1.1

Bugzilla=4.1.2

Bugzilla=4.1.3

Bugzilla=4.2

Bugzilla=4.2-rc1

Bugzilla=4.2-rc2

Bugzilla=4.2.1

Bugzilla=4.2.2

Bugzilla=4.2.3

Bugzilla=4.2.4

Bugzilla=4.3

Bugzilla=4.3.1

Bugzilla=4.3.2

Bugzilla=4.3.3

Bugzilla=4.4-rc1

Event History

Feb 24, 2013

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-0785?

CVE-2013-0785 is classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2013-0785?

To fix CVE-2013-0785, upgrade Bugzilla to version 3.6.13, 4.0.10, 4.2.5, or later.

What versions of Bugzilla are affected by CVE-2013-0785?

CVE-2013-0785 affects Bugzilla versions prior to 3.6.13, 4.0.10, 4.2.5, and several 4.x versions listed in the advisory.

Can CVE-2013-0785 be exploited remotely?

Yes, CVE-2013-0785 can be exploited remotely by attackers to inject malicious scripts through the ID parameter.

Is CVE-2013-0785 related to any other vulnerabilities?