4.3

CVE-2013-0785

Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter.

Data is provided by the National Vulnerability Database (NVD)
MozillaBugzilla Version <= 3.6.12
MozillaBugzilla Version3.6
MozillaBugzilla Version3.6 Updaterc1
MozillaBugzilla Version3.6.0
MozillaBugzilla Version3.6.1
MozillaBugzilla Version3.6.2
MozillaBugzilla Version3.6.3
MozillaBugzilla Version3.6.4
MozillaBugzilla Version3.6.5
MozillaBugzilla Version3.6.6
MozillaBugzilla Version3.6.7
MozillaBugzilla Version3.6.8
MozillaBugzilla Version3.6.9
MozillaBugzilla Version3.6.10
MozillaBugzilla Version3.6.11
MozillaBugzilla Version3.7
MozillaBugzilla Version3.7.1
MozillaBugzilla Version3.7.2
MozillaBugzilla Version3.7.3
MozillaBugzilla Version4.0
MozillaBugzilla Version4.0 Updaterc1
MozillaBugzilla Version4.0 Updaterc2
MozillaBugzilla Version4.0.1
MozillaBugzilla Version4.0.2
MozillaBugzilla Version4.0.3
MozillaBugzilla Version4.0.4
MozillaBugzilla Version4.0.5
MozillaBugzilla Version4.0.6
MozillaBugzilla Version4.0.7
MozillaBugzilla Version4.0.8
MozillaBugzilla Version4.0.9
MozillaBugzilla Version4.1
MozillaBugzilla Version4.1.1
MozillaBugzilla Version4.1.2
MozillaBugzilla Version4.1.3
MozillaBugzilla Version4.2
MozillaBugzilla Version4.2 Updaterc1
MozillaBugzilla Version4.2 Updaterc2
MozillaBugzilla Version4.2.1
MozillaBugzilla Version4.2.2
MozillaBugzilla Version4.2.3
MozillaBugzilla Version4.2.4
MozillaBugzilla Version4.3
MozillaBugzilla Version4.3.1
MozillaBugzilla Version4.3.2
MozillaBugzilla Version4.3.3
MozillaBugzilla Version4.4 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.3% 0.5
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.