CVE-2008-2103

Bugzilla 2.17.2 and later - Cross-Site Scripting via id Parameter

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later allows remote attackers to inject arbitrary web script or HTML via the id parameter to the "Format for Printing" view or "Long Format" bug list.

References (10)

Core 10
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29038
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=425665
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30167
Vendor Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00036.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1019967
Vendor Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00098.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30064
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42216
Issue Tracking x_refsource_confirm
http://www.bugzilla.org/security/2.20.5/
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1428/references

Scores

EPSS 0.0135
EPSS Percentile 68.3%

Details

CWE
CWE-79
Status published
Products (44)
mozilla/bugzilla 2.17.2
mozilla/bugzilla 2.17.3
mozilla/bugzilla 2.17.4
mozilla/bugzilla 2.17.5
mozilla/bugzilla 2.17.6
mozilla/bugzilla 2.17.7
mozilla/bugzilla 2.18 rc1 (3 CPE variants)
mozilla/bugzilla 2.18.1
mozilla/bugzilla 2.18.2
mozilla/bugzilla 2.18.3
... and 34 more
Published May 07, 2008
Tracked Since Feb 18, 2026