According to its banner, the version of Bugzilla installed on the remote host contains multiple flaws. It is, therefore, affected by the following vulnerabilities :

  - If a new comment is marked as private to the insider     group, and a flag is set in the same transaction, the     comment will be visible to flag recipients even if they     are not in the insider group. (CVE-2014-1571)

  - A remote attacker can override certain parameters when     creating a new Bugzilla account. This can lead to the     account being created with a different email address     than originally requested, allowing a user to be added     to certain groups based on the group's regular     expression setting. This may allow an attacker to     escalate a given user accounts privileges.
    (CVE-2014-1572)

  - A flaw existed in how CGI arguments were handled that     could allow cross-site scripting exploits which an     attacker could use to access sensitive information.
    (CVE-2014-1573)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Bugzilla < 4.0.15 / 4.2.11 / 4.4.6 / 4.5.6 Multiple Vulnerabilities

medium Nessus Plugin ID 78069

Version 1.12

Version 1.11

Version 1.12 May 15, 2025, 5:17 AM Detection (remove script_exclude_keys for CGI scanning) Plugin Feed: 202505150517
Version 1.11 Jun 4, 2024, 12:08 PM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202406041208