CVE-2012-0440 — Cross-Site Request Forgery in Mozilla Bugzilla

CWE-352 — Cross-Site Request Forgery6 documents4 sources
Severity
5.1MEDIUMNVD
EPSS
0.2%
top 60.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Bugzilla
Timeline
PublishedFeb 2
Latest updateMay 4

Description

Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages1 packages

▶NVDmozilla/bugzilla26 versions+25

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-8gpf-9xrv-wwpx: Cross-site request forgery (CSRF) vulnerability in jsonrpc↗2022-05-04
▶
CVEList
CVE-2012-0440: Cross-site request forgery (CSRF) vulnerability in jsonrpc↗2012-02-02
▶

💬Community

3
Bugzilla
CVE-2012-0440 CVE-2012-0448 bugzila: two flaws fixed in 4.2rc2, 4.0.4, 3.6.8, and 3.4.14 [epel-all]↗2012-02-01
▶
Bugzilla
CVE-2012-0440 CVE-2012-0448 bugzila: two flaws fixed in 4.2rc2, 4.0.4, 3.6.8, and 3.4.14↗2012-02-01
▶
Bugzilla
CVE-2012-0440 CVE-2012-0448 bugzila: two flaws fixed in 4.2rc2, 4.0.4, 3.6.8, and 3.4.14 [fedora-all]↗2012-02-01
▶
CVE-2012-0440 — Cross-Site Request Forgery in Mozilla | cvebase