CVE-2011-2379

UNKNOWN

Cross-site scripting (XSS) vulnerability in Bugzilla 2

Published Aug 9, 2011

Modified 1 years ago

Details

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

References

ADVISORYhttp://secunia.com/advisories/45501 WEBhttp://www.bugzilla.org/security/3.4.11/ADVISORYhttp://www.debian.org/security/2011/dsa-2322 WEBhttp://www.osvdb.org/74297 WEBhttp://www.securityfocus.com/bid/49042 WEBhttps://bugzilla.mozilla.org/show_bug.cgi?id=637981 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/69033 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2011-2379

CVSS Analysis

CVSS v2.0

4.3

Exploitability

Access Vector

NetworkAV:N

Access Complexity

MediumAC:M

Authentication

NoneAu:N

Impact

Confidentiality

NoneC:N

Integrity

PartialI:P

Availability

NoneA:N

4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N

Ecosystems

Timeline

PublishedAug 9, 2011

ModifiedAug 6, 2024