Description
Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.
References
- FEDORA-2009-3405 vendor-advisory
- ADV-2009-0887 vdb-entry
- bugzilla-attachment-csrf(49524) vdb-entry
- http://www.bugzilla.org/security/3.2.2/
- 34545 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=476603
- 34308 vdb-entry
- 34547 third-party-advisory
- FEDORA-2009-3410 vendor-advisory
- 34624 third-party-advisory