CVE-2018-5123

CWE-352 — Cross-Site Request Forgery (CSRF)6 documents4 sources

Severity

8.8HIGH

EPSS

0.1%

top 65.84%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Bugzilla

Timeline

PublishedApr 29

Latest updateMay 24

Description

A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDmozilla/bugzilla< 4.4

▶CVEListV5mozilla/bugzillaAll versions prior to Bugzilla 4.4

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

GHSA

GHSA-h29x-g5g9-4c57: A third party website can access information available to a user with access to a restricted bug entry using the image generation in report↗2022-05-24

▶

CVEList

CVE-2018-5123: A third party website can access information available to a user with access to a restricted bug entry using the image generation in report↗2019-04-29

▶

💬Community

Bugzilla

CVE-2018-20669 kernel: missing access_ok() checks in i915_gem_execbuffer2_ioctl() results in priviledge escalation↗2019-01-24

▶

Bugzilla

CVE-2018-5123 bugzilla: CSRF in report.cgi allows to extract confidential information from a bug↗2018-02-19

▶

Bugzilla

CVE-2018-5123 bugzilla: CSRF in report.cgi allows to extract confidential information from a bug [epel-6]↗2018-02-19

▶