CVEvulnerability
CVE-2014-1517
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-04-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-287
Description
The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
Affected configurations
• mozilla bugzilla 2.0
• mozilla bugzilla 2.2
• mozilla bugzilla 2.4
• mozilla bugzilla 2.6
• mozilla bugzilla 2.8
• mozilla bugzilla 2.9
• mozilla bugzilla 2.10
• mozilla bugzilla 2.12
• mozilla bugzilla 2.14
• mozilla bugzilla 2.14.1
• mozilla bugzilla 2.14.2
• mozilla bugzilla 2.14.3
• mozilla bugzilla 2.14.4
• mozilla bugzilla 2.14.5
• mozilla bugzilla 2.16
• mozilla bugzilla 2.16.1
• mozilla bugzilla 2.16.2
• mozilla bugzilla 2.16.3
• mozilla bugzilla 2.16.4
• mozilla bugzilla 2.16.5
• mozilla bugzilla 2.16.6
• mozilla bugzilla 2.16.7
• mozilla bugzilla 2.16.8
• mozilla bugzilla 2.16.9
• mozilla bugzilla 2.16.10
• mozilla bugzilla 2.16.11
• mozilla bugzilla 2.17
• mozilla bugzilla 2.17.1
• mozilla bugzilla 2.17.2
• mozilla bugzilla 2.17.3
• mozilla bugzilla 2.17.4
• mozilla bugzilla 2.17.5
• mozilla bugzilla 2.17.6
• mozilla bugzilla 2.17.7
• mozilla bugzilla 2.18
• mozilla bugzilla 2.18.1
• mozilla bugzilla 2.18.2
• mozilla bugzilla 2.18.3
• mozilla bugzilla 2.18.4
• mozilla bugzilla 2.18.5
• mozilla bugzilla 2.18.6
• mozilla bugzilla 2.18.6\+
• mozilla bugzilla 2.18.7
• mozilla bugzilla 2.18.8
• mozilla bugzilla 2.18.9
• mozilla bugzilla 2.19
• mozilla bugzilla 2.19.1
• mozilla bugzilla 2.19.2
• mozilla bugzilla 2.19.3
• mozilla bugzilla 2.20
• mozilla bugzilla 2.20.1
• mozilla bugzilla 2.20.2
• mozilla bugzilla 2.20.3
• mozilla bugzilla 2.20.4
• mozilla bugzilla 2.20.5
• mozilla bugzilla 2.20.6
• mozilla bugzilla 2.20.7
• mozilla bugzilla 2.21
• mozilla bugzilla 2.21.1
• mozilla bugzilla 2.21.2
… and 124 more
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://git.mozilla.org/?p=bugzilla/bugzilla.git%3Ba=commit%3Bh=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 git.mozilla.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132281.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.html lists.fedoraproject.org
- http://www.bugzilla.org/security/4.0.11/ Vendor Advisory
- http://www.securitytracker.com/id/1030128 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=713926 Patch
- http://git.mozilla.org/?p=bugzilla/bugzilla.git%3Ba=commit%3Bh=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 git.mozilla.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132281.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.html lists.fedoraproject.org
- http://www.bugzilla.org/security/4.0.11/ Vendor Advisory
- http://www.securitytracker.com/id/1030128 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=713926 Patch