CVE-2014-1517: CSRF
Published Apr 20, 2014
·Updated
The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
Affected Software
204 affected components
Bugzilla=2.0
Bugzilla=2.2
Bugzilla=2.4
Bugzilla=2.6
Bugzilla=2.8
Bugzilla=2.9
Bugzilla=2.10
Bugzilla=2.12
Bugzilla=2.14
Bugzilla=2.14.1
Bugzilla=2.14.2
Bugzilla=2.14.3
Bugzilla=2.14.4
Bugzilla=2.14.5
Bugzilla=2.16
Bugzilla=2.16-rc1
Bugzilla=2.16-rc2
Bugzilla=2.16.1
Bugzilla=2.16.2
Bugzilla=2.16.3
Bugzilla=2.16.4
Bugzilla=2.16.5
Bugzilla=2.16.6
Bugzilla=2.16.7
Bugzilla=2.16.8
Bugzilla=2.16.9
Bugzilla=2.16.10
Bugzilla=2.16.11
Bugzilla=2.17
Bugzilla=2.17.1
Bugzilla=2.17.2
Bugzilla=2.17.3
Bugzilla=2.17.4
Bugzilla=2.17.5
Bugzilla=2.17.6
Bugzilla=2.17.7
Bugzilla=2.18
Bugzilla=2.18-rc1
Bugzilla=2.18-rc2
Bugzilla=2.18-rc3
Bugzilla=2.18.1
Bugzilla=2.18.2
Bugzilla=2.18.3
Bugzilla=2.18.4
Bugzilla=2.18.5
Bugzilla=2.18.6
Bugzilla=2.18.6\+
Bugzilla=2.18.7
Bugzilla=2.18.8
Bugzilla=2.18.9
Bugzilla=2.19
Bugzilla=2.19.1
Bugzilla=2.19.2
Bugzilla=2.19.3
Bugzilla=2.20
Bugzilla=2.20-rc1
Bugzilla=2.20-rc2
Bugzilla=2.20.1
Bugzilla=2.20.2
Bugzilla=2.20.3
Bugzilla=2.20.4
Bugzilla=2.20.5
Bugzilla=2.20.6
Bugzilla=2.20.7
Bugzilla=2.21
Bugzilla=2.21.1
Bugzilla=2.21.2
Bugzilla=2.21.2-rc1
Bugzilla=2.22
Bugzilla=2.22-rc1
Bugzilla=2.22.1
Bugzilla=2.22.2
Bugzilla=2.22.3
Bugzilla=2.22.4
Bugzilla=2.22.5
Bugzilla=2.22.6
Bugzilla=2.22.7
Bugzilla=2.23
Bugzilla=2.23.1
Bugzilla=2.23.2
Bugzilla=2.23.3
Bugzilla=2.23.4
Bugzilla=3.0
Bugzilla=3.0-rc1
Bugzilla=3.0.0
Bugzilla=3.0.1
Bugzilla=3.0.2
Bugzilla=3.0.3
Bugzilla=3.0.4
Bugzilla=3.0.5
Bugzilla=3.0.6
Bugzilla=3.0.7
Bugzilla=3.0.8
Bugzilla=3.0.9
Bugzilla=3.0.10
Bugzilla=3.0.11
Bugzilla=3.1.0
Bugzilla=3.1.1
Bugzilla=3.1.2
Bugzilla=3.1.3
Bugzilla=3.1.4
Bugzilla=3.2
Bugzilla=3.2-rc1
Bugzilla=3.2-rc2
Bugzilla=3.2.1
Bugzilla=3.2.2
Bugzilla=3.2.3
Bugzilla=3.2.4
Bugzilla=3.2.5
Bugzilla=3.2.6
Bugzilla=3.2.7
Bugzilla=3.2.8
Bugzilla=3.2.9
Bugzilla=3.2.10
Bugzilla=3.3
Bugzilla=3.3.1
Bugzilla=3.3.2
Bugzilla=3.3.3
Bugzilla=3.3.4
Bugzilla=3.4
Bugzilla=3.4-rc1
Bugzilla=3.4.1
Bugzilla=3.4.2
Bugzilla=3.4.3
Bugzilla=3.4.4
Bugzilla=3.4.5
Bugzilla=3.4.6
Bugzilla=3.4.7
Bugzilla=3.4.8
Bugzilla=3.4.9
Bugzilla=3.4.10
Bugzilla=3.4.11
Bugzilla=3.4.12
Bugzilla=3.4.13
Bugzilla=3.5
Bugzilla=3.5.1
Bugzilla=3.5.2
Bugzilla=3.5.3
Bugzilla=3.6
Bugzilla=3.6-rc1
Bugzilla=3.6.0
Bugzilla=3.6.1
Bugzilla=3.6.2
Bugzilla=3.6.3
Bugzilla=3.6.4
Bugzilla=3.6.5
Bugzilla=3.6.6
Bugzilla=3.6.7
Bugzilla=3.6.8
Bugzilla=3.6.9
Bugzilla=3.6.10
Bugzilla=3.6.11
Bugzilla=3.6.12
Bugzilla=3.6.13
Bugzilla=3.7
Bugzilla=3.7.1
Bugzilla=3.7.2
Bugzilla=3.7.3
Bugzilla=4.0
Bugzilla=4.0-rc1
Bugzilla=4.0-rc2
Bugzilla=4.0.1
Bugzilla=4.0.2
Bugzilla=4.0.3
Bugzilla=4.0.4
Bugzilla=4.0.5
Bugzilla=4.0.6
Bugzilla=4.0.7
Bugzilla=4.0.8
Bugzilla=4.0.9
Bugzilla=4.0.10
Bugzilla=4.0.11
Bugzilla=4.0.12
Bugzilla=4.0.13
Bugzilla=4.1
Bugzilla=4.1.1
Bugzilla=4.1.2
Bugzilla=4.1.3
Bugzilla=4.2
Bugzilla=4.2-rc1
Bugzilla=4.2-rc2
Bugzilla=4.2.1
Bugzilla=4.2.2
Bugzilla=4.2.3
Bugzilla=4.2.4
Bugzilla=4.2.5
Bugzilla=4.2.6
Bugzilla=4.2.7
Bugzilla=4.2.8
Bugzilla=4.2.9
Bugzilla=4.3
Bugzilla=4.3.1
Bugzilla=4.3.2
Bugzilla=4.3.3
Bugzilla=4.4
Bugzilla=4.4-rc1
Bugzilla=4.4-rc2
Bugzilla=4.4.1
Bugzilla=4.4.2
Bugzilla=4.5
Bugzilla=4.5.1
Bugzilla=4.5.2
fedoraproject fedora=19
fedoraproject fedora=20
Remediation
Patch Available
Event History
Apr 20, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·01:55 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1517?
CVE-2014-1517 has a medium severity rating due to its potential to expose sensitive user information.
2
How do I fix CVE-2014-1517?
To fix CVE-2014-1517, update Bugzilla to version 4.4.3 or later.
3
Who is affected by CVE-2014-1517?
CVE-2014-1517 affects all versions of Bugzilla from 2.x to 4.5.x before 4.5.3.
4
What type of vulnerability is CVE-2014-1517?
CVE-2014-1517 is a vulnerability related to authentication issues in the Bugzilla login process.
5
What can attackers do with CVE-2014-1517?
Attackers can exploit CVE-2014-1517 to obtain sensitive information by tricking victims into logging into their accounts.