CVE-2010-4570 — Cross-site Scripting in Mozilla Bugzilla

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 30.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Bugzilla
Timeline
PublishedJan 28
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the summary field, related to the DataTable widget in YUI.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDmozilla/bugzilla4 versions+3

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-4mw2-9w62-mvpx: Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3↗2022-05-17
▶
CVEList
CVE-2010-4570: Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3↗2011-01-28
▶
CVE-2010-4570 — Cross-site Scripting in Mozilla | cvebase