CVE-2013-1733: mozilla bugzilla Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2013-1733 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in mozilla bugzilla. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-10-2013
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision token.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.