PT-2012-2574
CVE-2012-0453
·
تاريخ النشر
2012-02-25
·
تاريخ التحديث
2018-01-11
الوصف من
CVSS 2.0
5.1
متوسطةالمقاييسAV:N/AC:H/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
Bugzilla versions 4.0.2 through 4.0.4
Bugzilla versions 4.1.1 through 4.2rc2
Description
A cross-site request forgery issue affects the xmlrpc.cgi component in Bugzilla when mod perl is used. This allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.
Recommendations
For Bugzilla versions 4.0.2 through 4.0.4, update to a version outside of this range to resolve the issue.
For Bugzilla versions 4.1.1 through 4.2rc2, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider disabling the xmlrpc.cgi component until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾