FreeBSD : bugzilla -- Cross-Site Request Forgery (608ed765-c700-11e3-848c-20cf30e32f6d)

medium Nessus Plugin ID 73632

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

A Bugzilla Security Advisory reports : The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.

Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 73632

File Name: freebsd_pkg_608ed765c70011e3848c20cf30e32f6d.nasl

Version: 1.6

Type: local

Family: FreeBSD Local Security Checks

Published: 4/21/2014

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: Medium

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:bugzilla42, p-cpe:/a:freebsd:freebsd:bugzilla40, cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:bugzilla44

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 4/18/2014

Vulnerability Publication Date: 4/17/2014

Reference Information

CVE: CVE-2014-1517

Detections

Analytics