VulnerabilityModified

CVE-2007-4543

Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the buildid field in the "guided form."

MEDIUM 4.3EPSS 1.36%

Does this matter?

Lower severity and a low EPSS score (1.36%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 1.36% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: mozilla/bugzilla
Source: cve@mitre.org

References

http://osvdb.org/37201
http://secunia.com/advisories/26584Patch, Vendor Advisory
http://secunia.com/advisories/26971
http://security.gentoo.org/glsa/glsa-200709-18.xml
http://www.bugzilla.org/security/2.20.4/
http://www.securityfocus.com/archive/1/477630/100/0/threaded
http://www.securityfocus.com/bid/25425Exploit, Patch
http://www.securitytracker.com/id?1018604
http://www.vupen.com/english/advisories/2007/2977
https://bugzilla.mozilla.org/show_bug.cgi?id=386942
https://exchange.xforce.ibmcloud.com/vulnerabilities/36241
http://osvdb.org/37201
http://secunia.com/advisories/26584Patch, Vendor Advisory
http://secunia.com/advisories/26971
http://security.gentoo.org/glsa/glsa-200709-18.xml
http://www.bugzilla.org/security/2.20.4/
http://www.securityfocus.com/archive/1/477630/100/0/threaded
http://www.securityfocus.com/bid/25425Exploit, Patch
http://www.securitytracker.com/id?1018604
http://www.vupen.com/english/advisories/2007/2977
https://bugzilla.mozilla.org/show_bug.cgi?id=386942
https://exchange.xforce.ibmcloud.com/vulnerabilities/36241

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.