CVE-2013-1733
published 2013-10-24CVE-2013-1733: Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of…
PriorityP427medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
0.58%
44.2th percentile
Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision token.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | bugzilla | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1734 CVE-2013-1742 CVE-2013-1743 bugzilla: multiple flaws corrected in upstream 4.0.11, 4.2.7, 4.4.1
bugzilla·2013-10-17·CVSS 4.3
CVE-2013-1734 [MEDIUM] CVE-2013-1734 CVE-2013-1742 CVE-2013-1743 bugzilla: multiple flaws corrected in upstream 4.0.11, 4.2.7, 4.4.1
CVE-2013-1734 CVE-2013-1742 CVE-2013-1743 bugzilla: multiple flaws corrected in upstream 4.0.11, 4.2.7, 4.4.1
A number of flaws were reported in Bugzilla [1]:
Class: Cross-Site Request Forgery
Versions: 2.16rc1 to 4.0.10, 4.1.1 to 4.2.6, 4.3.1 to 4.4
Fixed In: 4.0.11, 4.2.7, 4.4.1
Description: When an attachment is edited, a token is generated to
validate changes made by the user. Using a crafted URL,
an attacker could force the token to be recreated,
allowing him to bypass the token check and abuse a user
to commit changes on his behalf.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=913904
CVE Number: CVE-2013-1734
Class: Cross-Site Scripting
Versions: 2.17.1 to 4.0.10, 4.1.1 to 4.2.6, 4.3.1 to 4.4
Fixed In: 4.0.11, 4.2.7, 4.4.1
Description: Some parameters passed to editf
Bugzilla
[SECURITY] CSRF in process_bug.cgi
bugzilla·2013-09-01
[HIGH] [SECURITY] CSRF in process_bug.cgi
[SECURITY] CSRF in process_bug.cgi
PoC: (Changes in the bug with ID 21951 - landfill.bugzilla.org)
Discussion:
Confirmed! This is a regression due to bug 69447 which generates a new valid token without first making sure that the midair collision page will be displayed. This bug only affects 4.4 and newer. 4.3.3 and older are not affected.
---
I'm on it. Easy to fix.
---
Created attachment 798337
patch, v1
The new token must only be generated when we are going to display the midair collision page. Also, I had to validate delta_ts, else it was possible to crash PostgreSQL if you passed an invalid one.
---
Assigning CVE-2013-1733 to this vulnerability.
---
Comment on attachment 798337
patch, v1
Review of attachment 798337:
2013-10-24
Published