CVE-2009-0483

Bugzilla 2.22-2.22.6, 3.0-3.0.6, 3.2-3.2.0, 3.3-3.3.1 - Cross-Site Request Forgery via editkeywords.cgi or userprefs.cgi

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi.

References (7)

Core 7
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=466692
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34361
Issue Tracking x_refsource_confirm
http://www.bugzilla.org/security/2.22.6/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/33580
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=472362

Scores

EPSS 0.0060
EPSS Percentile 44.5%

Details

CWE
CWE-352
Status published
Products (44)
mozilla/bugzilla 2.10
mozilla/bugzilla 2.12
mozilla/bugzilla 2.14
mozilla/bugzilla 2.14.1
mozilla/bugzilla 2.14.2
mozilla/bugzilla 2.14.3
mozilla/bugzilla 2.14.4
mozilla/bugzilla 2.14.5
mozilla/bugzilla 2.16 (2 CPE variants)
mozilla/bugzilla 2.16.1
... and 34 more
Published Feb 09, 2009
Tracked Since Feb 18, 2026