CVE-2009-0486 — Cross-Site Request Forgery in Mozilla Bugzilla

CWE-352 — Cross-Site Request Forgery7 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 65.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Bugzilla
Timeline
PublishedFeb 9
Latest updateMay 2

Description

Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDmozilla/bugzilla3.0.7, 3.2.1, 3.3.2+2

🔴Vulnerability Details

2
GHSA
GHSA-r4gm-vpf3-q479: Bugzilla 3↗2022-05-02
▶
CVEList
CVE-2009-0486: Bugzilla 3↗2009-02-09
▶

📋Vendor Advisories

1
Red Hat
bugzilla: CSRF protection bypass when running under mod_perl↗2009-02-09
▶

💬Community

3
Bugzilla
CVE-2009-0486 bugzilla: CSRF protection bypass when running under mod_perl↗2009-02-10
▶
Bugzilla
CVE-2008-4437 CVE-2008-6098, CVE-2009-048[13456] bugzilla: multiple issues [F10]↗2009-02-09
▶
Bugzilla
CVE-2008-4437 CVE-2008-6098, CVE-2009-048[13456] bugzilla: multiple issues [F9]↗2009-02-09
▶
CVE-2009-0486 — Cross-Site Request Forgery in Mozilla | cvebase