VDB
CVE-2014-1517
CVE-2014-1517
PUBLISHED
CVSS 4 MEDIUM
The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
EPSS 1.31% · 69.7th percentile
Risk Scores
CVSS 2.0
4
EPSS Score
1.31%
69.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | * |
| mozilla | bugzilla | 2.18.8, 3.7.2, 3.4.6 |
| fedoraproject | fedora | 20, 19 |
Timeline
- Apr 20, 2014 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Oct 29, 2022 EPSS Score
- Dec 21, 2022 EPSS Score
- Feb 12, 2023 EPSS Score
- Apr 7, 2023 EPSS Score
- May 30, 2023 EPSS Score
- Jul 22, 2023 EPSS Score
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=713926 url
- http://www.bugzilla.org/security/4.0.11/ url
- FEDORA-2014-5414 vendor-advisory
- http://git.mozilla.org/?p=bugzilla/bugzilla.git%3Ba=commit%3Bh=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 url
- FEDORA-2014-5433 vendor-advisory
- 1030128 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2014-1517 advisory
- http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commit;h=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 url
- http://www.bugzilla.org/security/4.0.11 url