Back to Database
Status published
Medium
CVE-2011-0048
Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and...
Vulnerability Description
Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-0048
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/45982
- http://secunia.com/advisories/43165
- http://www.bugzilla.org/security/3.2.9/
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
- http://www.vupen.com/english/advisories/2011/0271
- http://secunia.com/advisories/43033
- http://www.vupen.com/english/advisories/2011/0207
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
- http://osvdb.org/70704
- https://bugzilla.mozilla.org/show_bug.cgi?id=628034
- http://www.debian.org/security/2011/dsa-2322
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65005
More from mozilla
View All →CVE-2025-66453
Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function
Medium
5.5
CVE-2022-29167
ReDoS vulnerability in header parsing in hawk
High
7.4
CVE-2021-21354
Open redirect in pollbot
High
7.4
CVE-2020-15660
Missing checks on Content-Type headers in geckodriver before 0.27.0 could...
High
8.8
CVE-2018-7753
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes...
Critical
9.8
Affected Vendor
mozilla
View all reports →Affected Software
bugzilla
Vulnerable Versions:
0, 2.0, 2.2, 2.4, 2.6, 2.8, 2.9, 2.10, 2.12, 2.14, 2.14.1, 2.14.2, 2.14.3, 2.14.4, 2.14.5, 2.16, 2.16.1, 2.16.2, 2.16.3, 2.16.4, 2.16.5, 2.16.6, 2.16.7, 2.16.8, 2.16.9, 2.16.10, 2.16.11, 2.16_rc2, 2.17, 2.17.1, 2.17.2, 2.17.3, 2.17.4, 2.17.5, 2.17.6, 2.17.7, 2.18, 2.18.1, 2.18.2, 2.18.3, 2.18.4, 2.18.5, 2.18.6, 2.18.6\+, 2.18.7, 2.18.8, 2.18.9, 2.19, 2.19.1, 2.19.2, 2.19.3, 2.20, 2.20.1, 2.20.2, 2.20.3, 2.20.4, 2.20.5, 2.20.6, 2.20.7, 2.21, 2.21.1, 2.21.2, 2.22, 2.22.1, 2.22.2, 2.22.3, 2.22.4, 2.22.5, 2.22.6, 2.22.7, 2.23, 2.23.1, 2.23.2, 2.23.3, 2.23.4, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 4.0
Timeline
Official Publish:
January 28th, 2011
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.