CVE-2010-4569

2011-01-2816:00:02

CWE-79

[email protected]

web.nvd.nist.gov

cve-2010-4569

cross-site scripting

xss vulnerability

bugzilla

remote attackers

arbitrary web script

html

autocomplete widget

yui

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.6%

JSON

Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the real name field of a user account, related to the AutoComplete widget in YUI.

Affected configurations

NVD

Node

mozillabugzillaMatch3.7.1

mozillabugzillaMatch3.7.2

mozillabugzillaMatch3.7.3

mozillabugzillaMatch4.0rc1

CPENameOperatorVersion
mozilla:bugzillamozilla bugzillaeq3.7.1
mozilla:bugzillamozilla bugzillaeq3.7.2
mozilla:bugzillamozilla bugzillaeq3.7.3
mozilla:bugzillamozilla bugzillaeq4.0

CPE	Name	Operator	Version
mozilla:bugzilla	mozilla bugzilla	eq	3.7.1
mozilla:bugzilla	mozilla bugzilla	eq	3.7.2
mozilla:bugzilla	mozilla bugzilla	eq	3.7.3
mozilla:bugzilla	mozilla bugzilla	eq	4.0