{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-03-30T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "FEDORA-2009-3405", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html"}, {"name": "ADV-2009-0887", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/0887"}, {"name": "bugzilla-attachment-csrf(49524)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49524"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.bugzilla.org/security/3.2.2/"}, {"name": "34545", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34545"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=476603"}, {"name": "34308", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/34308"}, {"name": "34547", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34547"}, {"name": "FEDORA-2009-3410", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html"}, {"name": "34624", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34624"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-1213", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "FEDORA-2009-3405", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html"}, {"name": "ADV-2009-0887", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/0887"}, {"name": "bugzilla-attachment-csrf(49524)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49524"}, {"name": "http://www.bugzilla.org/security/3.2.2/", "refsource": "CONFIRM", "url": "http://www.bugzilla.org/security/3.2.2/"}, {"name": "34545", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34545"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=476603", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=476603"}, {"name": "34308", "refsource": "BID", "url": "http://www.securityfocus.com/bid/34308"}, {"name": "34547", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34547"}, {"name": "FEDORA-2009-3410", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html"}, {"name": "34624", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34624"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:04:49.374Z"}, "title": "CVE Program Container", "references": [{"name": "FEDORA-2009-3405", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html"}, {"name": "ADV-2009-0887", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/0887"}, {"name": "bugzilla-attachment-csrf(49524)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49524"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.bugzilla.org/security/3.2.2/"}, {"name": "34545", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/34545"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=476603"}, {"name": "34308", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/34308"}, {"name": "34547", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/34547"}, {"name": "FEDORA-2009-3410", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html"}, {"name": "34624", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/34624"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-1213", "datePublished": "2009-04-01T10:00:00", "dateReserved": "2009-03-31T00:00:00", "dateUpdated": "2024-08-07T05:04:49.374Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:bugzilla:3.2:*:*:*:*:*:*:*", "matchCriteriaId": "F248EA4D-1A39-40FD-8D3C-9701D36FD6B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "170EB43B-9488-4E25-9401-B84DE838247B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "B1ED7682-A315-4F92-9F9F-38290BCC058E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "14B5A433-526F-436E-9FCD-B71E661180FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "48EDC5BC-AD4B-4E67-B79C-F44292307AB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "BEB4EF1D-D4D0-40DA-BE78-24FD48030EE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "B2962084-F778-4574-8105-8C5A260CCBD7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "FF288A74-070E-4EB4-BB92-7D4D41635DD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "5B8B31F0-6FCC-4258-865B-B65ECBFAF252", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en attachment.cgi de Bugzilla v3.2 anterior a v3.2.3, v3.3 anterior a v3.3.4 y versiones anteriores, permiten a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios aleatorios de solicitudes que utilizan la edici\u00f3n de adjuntos."}], "id": "CVE-2009-1213", "lastModified": "2017-08-17T01:30:14.067", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-04-01T10:30:00.453", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/34545"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/34547"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/34624"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.bugzilla.org/security/3.2.2/"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/34308"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/0887"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=476603"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49524"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "bugzilla: CSRF vulnerability in attachment editing", "id": "494398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=494398"}, "csaw": false, "cwe": "CWE-352", "details": ["Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing."], "name": "CVE-2009-1213", "public_date": "2009-03-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-1213\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-1213"], "threat_severity": "Moderate"}