FreeBSD : bugzilla -- Cross-Site Request Forgery (608ed765-c700-11e3-848c-20cf30e32f6d)

Medium Nessus Plugin ID 73632


The remote FreeBSD host is missing one or more security-related updates.


A Bugzilla Security Advisory reports : The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.

Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.


Update the affected packages.

See Also

Plugin Details

Severity: Medium

ID: 73632

File Name: freebsd_pkg_608ed765c70011e3848c20cf30e32f6d.nasl

Version: $Revision: 1.3 $

Type: local

Published: 2014/04/21

Modified: 2014/04/23

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:bugzilla40, p-cpe:/a:freebsd:freebsd:bugzilla42, p-cpe:/a:freebsd:freebsd:bugzilla44, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2014/04/18

Vulnerability Publication Date: 2014/04/17

Reference Information

CVE: CVE-2014-1517