CVE-2009-0485

Bugzilla 2.17-2.22.7, 3.0-3.0.6, 3.2-3.2.0, 3.3-3.3.1 - Cross-Site Request Forgery via editflagtypes.cgi

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete unused flag types via a link or IMG tag to editflagtypes.cgi.

References (6)

Core 6
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=466692
Vendor Advisory x_refsource_confirm
http://www.bugzilla.org/security/2.22.6/
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34361
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/33580

Scores

EPSS 0.0055
EPSS Percentile 42.1%

Details

CWE
CWE-352
Status published
Products (43)
mozilla/bugzilla 2.17
mozilla/bugzilla 2.17.1
mozilla/bugzilla 2.17.3
mozilla/bugzilla 2.17.4
mozilla/bugzilla 2.17.5
mozilla/bugzilla 2.17.6
mozilla/bugzilla 2.17.7
mozilla/bugzilla 2.18 (4 CPE variants)
mozilla/bugzilla 2.18.1
mozilla/bugzilla 2.18.2
... and 33 more
Published Feb 09, 2009
Tracked Since Feb 18, 2026