CVE-2012-0453

Published: 25 February 2012

Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.

Priority

Status

Package	Release	Status
bugzilla Launchpad, Ubuntu, Debian	hardy	Not vulnerable
	lucid	Not vulnerable
	maverick	Not vulnerable
	natty	Not vulnerable
	oneiric	Not vulnerable (3.6.3.0-2)
	upstream	Not vulnerable (3.6.2.0-4.5)

References

https://www.cve.org/CVERecord?id=CVE-2012-0453
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.