The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.

According to its banner, the version of Bugzilla installed on the remote host is after version 2.0 but prior to 4.4.3 / 4.5.3. It is, therefore, affected by a cross-site request forgery vulnerability.

The vulnerability exists with the login form and could allow a remote attacker to cause a user to login using the attacker's credentials, alerting the attacker of any bugs the user submits.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Previous versions of bugzilla had the following security issues :

  - The login form had no CSRF protection, meaning that an     attacker could force the victim to log in using the     attacker's credentials.

  - Dangerous control characters can be inserted into     Bugzilla, notably into bug comments, which can then be     used to execute local commands.

The first issue has the CVE number CVE-2014-1517. Please see http://www.bugzilla.org/security/4.0.11/ for all the gory details.

Both issues were fixed in 4.2.8 but it introduced a regression in bug commenting that was fixed in 4.2.9.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports : The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.

Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.

ID	Name	Product	Family	Severity
74107	Bugzilla 2.0 < 4.4.3 / 4.5.3 Login Form XSRF	Nessus	CGI abuses	medium
73778	Fedora 20 : bugzilla-4.2.9-1.fc20 (2014-5433)	Nessus	Fedora Local Security Checks	medium
73777	Fedora 19 : bugzilla-4.2.9-1.fc19 (2014-5414)	Nessus	Fedora Local Security Checks	medium
73632	FreeBSD : bugzilla -- Cross-Site Request Forgery (608ed765-c700-11e3-848c-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-1517

medium

Tenable Plugins

medium

medium

medium

medium