Description
Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the buildid field in the "guided form."
References
- GLSA-200709-18 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=386942
- 20070823 Security Advisory for Bugzilla 3.0, 2.22.1, and 2.20.4 mailing-list
- 37201 vdb-entry
- 26971 third-party-advisory
- ADV-2007-2977 vdb-entry
- bugzilla-buildid-xss(36241) vdb-entry
- 26584 third-party-advisory
- 1018604 vdb-entry
- 25425 vdb-entry
- http://www.bugzilla.org/security/2.20.4/