CVE-2011-2381

critical

Description

CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notification.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/69035

https://bugzilla.mozilla.org/show_bug.cgi?id=657158

http://www.securityfocus.com/bid/49042

http://www.osvdb.org/74300

http://www.debian.org/security/2011/dsa-2322

http://www.bugzilla.org/security/3.4.11/

http://secunia.com/advisories/45501

Details

Source: Mitre, NVD

Published: 2011-08-09

Updated: 2025-04-11

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.0048