CVE-2004-1061 — Cross-site Scripting in Mozilla Bugzilla

3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 31.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Bugzilla
Timeline
PublishedJan 4
Latest updateApr 29

Description

Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDmozilla/bugzilla18 versions+17

🔴Vulnerability Details

2
GHSA
GHSA-x79f-p7c2-c42g: Cross-site scripting (XSS) vulnerability in Bugzilla before 2↗2022-04-29
▶
CVEList
CVE-2004-1061: Cross-site scripting (XSS) vulnerability in Bugzilla before 2↗2004-12-31
▶
CVE-2004-1061 — Cross-site Scripting in Mozilla | cvebase