CVE-2011-2381

UNKNOWN

CRLF injection vulnerability in Bugzilla 2

Published Aug 9, 2011

Modified 1 years ago

Details

CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notification.

References

ADVISORYhttp://secunia.com/advisories/45501 WEBhttp://www.bugzilla.org/security/3.4.11/ADVISORYhttp://www.debian.org/security/2011/dsa-2322 WEBhttp://www.osvdb.org/74300 WEBhttp://www.securityfocus.com/bid/49042 WEBhttps://bugzilla.mozilla.org/show_bug.cgi?id=657158 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/69035 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2011-2381

CVSS Analysis

CVSS v2.0

4.3

Exploitability

Access Vector

NetworkAV:N

Access Complexity

MediumAC:M

Authentication

NoneAu:N

Impact

Confidentiality

NoneC:N

Integrity

PartialI:P

Availability

NoneA:N

4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N

Ecosystems

Timeline

PublishedAug 9, 2011

ModifiedAug 6, 2024

CVE-2011-2381 | Mondoo Vulnerability Intelligence