CVE-2013-0785 Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attacke...
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla bugzilla | <= 3.6.12 | No fix listed |
| mozilla bugzilla | = 3.6 | No fix listed |
| mozilla bugzilla | = 3.6-rc1 | No fix listed |
| mozilla bugzilla | = 3.6.0 | No fix listed |
| mozilla bugzilla | = 3.6.1 | No fix listed |
| mozilla bugzilla | = 3.6.2 | No fix listed |
| mozilla bugzilla | = 3.6.3 | No fix listed |
| mozilla bugzilla | = 3.6.4 | No fix listed |
| mozilla bugzilla | = 3.6.5 | No fix listed |
| mozilla bugzilla | = 3.6.6 | No fix listed |
| mozilla bugzilla | = 3.6.7 | No fix listed |
| mozilla bugzilla | = 3.6.8 | No fix listed |
| mozilla bugzilla | = 3.6.9 | No fix listed |
| mozilla bugzilla | = 3.6.10 | No fix listed |
| mozilla bugzilla | = 3.6.11 | No fix listed |
| mozilla bugzilla | = 3.7 | No fix listed |
| mozilla bugzilla | = 3.7.1 | No fix listed |
| mozilla bugzilla | = 3.7.2 | No fix listed |
| mozilla bugzilla | = 3.7.3 | No fix listed |
| mozilla bugzilla | = 4.0 | No fix listed |
| mozilla bugzilla | = 4.0-rc1 | No fix listed |
| mozilla bugzilla | = 4.0-rc2 | No fix listed |
| mozilla bugzilla | = 4.0.1 | No fix listed |
| mozilla bugzilla | = 4.0.2 | No fix listed |
| mozilla bugzilla | = 4.0.3 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla bugzilla | = 4.0.4 | No fix listed |
| mozilla bugzilla | = 4.0.5 | No fix listed |
| mozilla bugzilla | = 4.0.6 | No fix listed |
| mozilla bugzilla | = 4.0.7 | No fix listed |
| mozilla bugzilla | = 4.0.8 | No fix listed |
| mozilla bugzilla | = 4.0.9 | No fix listed |
| mozilla bugzilla | = 4.1 | No fix listed |
| mozilla bugzilla | = 4.1.1 | No fix listed |
| mozilla bugzilla | = 4.1.2 | No fix listed |
| mozilla bugzilla | = 4.1.3 | No fix listed |
| mozilla bugzilla | = 4.2 | No fix listed |
| mozilla bugzilla | = 4.2-rc1 | No fix listed |
| mozilla bugzilla | = 4.2-rc2 | No fix listed |
| mozilla bugzilla | = 4.2.1 | No fix listed |
| mozilla bugzilla | = 4.2.2 | No fix listed |
| mozilla bugzilla | = 4.2.3 | No fix listed |
| mozilla bugzilla | = 4.2.4 | No fix listed |
| mozilla bugzilla | = 4.3 | No fix listed |
| mozilla bugzilla | = 4.3.1 | No fix listed |
| mozilla bugzilla | = 4.3.2 | No fix listed |
| mozilla bugzilla | = 4.3.3 | No fix listed |
| mozilla bugzilla | = 4.4-rc1 | No fix listed |
References
- www.bugzilla.org vendor-advisory
- MDVSA-2013:066 vendor-advisory
- bugzilla.mozilla.org