CVE-2014-1573

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 4.0.x before 4.0.15 Bugzilla versions 4.1.x and 4.2.x before 4.2.11 Bugzilla versions 4.3.x and 4.4.x before 4.4.6 Bugzilla versions 4.5.x before 4.5.6

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name, due to the software not ensuring a scalar context is used for certain CGI parameters.

Recommendations For versions 2.x through 4.0.x before 4.0.15, update to version 4.0.15 or later. For versions 4.1.x and 4.2.x before 4.2.11, update to version 4.2.11 or later. For versions 4.3.x and 4.4.x before 4.4.6, update to version 4.4.6 or later. For versions 4.5.x before 4.5.6, update to version 4.5.6 or later.