CVEvulnerability
CVE-2006-2420
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2006-05-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.
Affected configurations
• mozilla bugzilla 2.20
• mozilla bugzilla 2.21
• mozilla bugzilla 2.21.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://marc.info/?l=bugtraq&m=112818466125484&w=2 marc.info
- http://secunia.com/advisories/18979 Patch, Vendor Advisory
- http://www.bugzilla.org/security/2.18.4 Patch, Vendor Advisory
- http://www.osvdb.org/23379 www.osvdb.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=313441 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24820 exchange.xforce.ibmcloud.com
- http://marc.info/?l=bugtraq&m=112818466125484&w=2 marc.info
- http://secunia.com/advisories/18979 Patch, Vendor Advisory
- http://www.bugzilla.org/security/2.18.4 Patch, Vendor Advisory
- http://www.osvdb.org/23379 www.osvdb.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=313441 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24820 exchange.xforce.ibmcloud.com