Description
Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.
References (5)
Core 5
Core References
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00664.html
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00687.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34361
Issue Tracking x_refsource_confirm
http://www.bugzilla.org/security/2.22.6/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/33580
Scores
EPSS
0.0074
EPSS Percentile
50.5%
Details
CWE
CWE-79
Status
published
Products (44)
mozilla/bugzilla
2.10
mozilla/bugzilla
2.12
mozilla/bugzilla
2.14
mozilla/bugzilla
2.14.1
mozilla/bugzilla
2.14.2
mozilla/bugzilla
2.14.3
mozilla/bugzilla
2.14.4
mozilla/bugzilla
2.14.5
mozilla/bugzilla
2.16 (2 CPE variants)
mozilla/bugzilla
2.16.1
... and 34 more
Published
Feb 09, 2009
Tracked Since
Feb 18, 2026