CVE-2015-8508
published 2016-01-03CVE-2015-8508: Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and…
PriorityP422medium4.7CVSS 3.0
AVNACHPRNUIRSCCLILAN
EPSS
1.48%
71.2th percentile
Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to inject arbitrary web script or HTML via a crafted bug summary.
Affected
147 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph [fedora-all]
bugzilla·2016-01-04·CVSS 4.7
CVE-2015-8508 [MEDIUM] CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph [fedora-all]
CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple support
Bugzilla
CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph
bugzilla·2016-01-04·CVSS 4.7
CVE-2015-8508 [MEDIUM] CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph
CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph
Upstream Bugzilla fixed the following issue:
During the generation of a dependency graph, the code for the HTML image map is generated locally if a local dot installation is used. With escaped HTML characters in a bug summary, it is possible to inject unfiltered HTML code in the map file which the CreateImagemap function generates. This could be used for a cross-site scripting attack.
This issue was fixed in versions 4.2.16, 4.4.11, and 5.0.2.
Upstream bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=1221518
Discussion:
Created bugzilla tracking bugs for this issue:
Affects: fedora-all [bug 1295437]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect
Bugzilla
[SECURITY] XSS in dependency graphs when displaying the bug summary
bugzilla·2015-11-04
[HIGH] [SECURITY] XSS in dependency graphs when displaying the bug summary
[SECURITY] XSS in dependency graphs when displaying the bug summary
During the generation of a dependency graph also the code for the html image map is generated if a local dot installation is used.
With html escaped characters in a bug summary it is possible to inject custom lines in the *.map file with which the CreateImagemap function generates html code without filtering.
poc:
- configure bugzilla to use a local dot installation to generate a dependency graph
- create a bug with the following summary:
default ">alert(1) G
- visit /showdependencygraph.cgi?id=&showsummary=on&display=tree&rankdir=TB, a javascript alert prompt will show up
Discussion:
Confirmed! Thanks for catching that.
---
Created attachment 8683094
patch for 5.0 and master, v1
The bug summary is escaped too late
http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Information-Leak.htmlhttp://seclists.org/bugtraq/2015/Dec/131http://www.securityfocus.com/bid/79660http://www.securitytracker.com/id/1034556https://bugzilla.mozilla.org/show_bug.cgi?id=1221518https://www.bugzilla.org/security/4.2.15/http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Information-Leak.htmlhttp://seclists.org/bugtraq/2015/Dec/131http://www.securityfocus.com/bid/79660http://www.securitytracker.com/id/1034556https://bugzilla.mozilla.org/show_bug.cgi?id=1221518https://www.bugzilla.org/security/4.2.15/
2016-01-03
Published