CVE-2010-4567

Published Jan 28, 2011 CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Description
Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bug_file_loc) field.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2322-1 bugzilla security update
EUVD EUVD EUVD-2010-4533 Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bug_file_loc) field.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 3:51 AM
Reserved
Dec 21, 2010, 12:00 AM
Status
Modified
Published
Jan 28, 2011, 4:00 PM
Modified
Jun 16, 2026, 11:25 PM